Mach33

okay, it must be the Windows machine, got on Mac and it doesn't distort the site...

I'm not sure on the details, but it seems like a CDN. For example, if you view the source for this webpage: view-source:https://mlpforums.com/profile/48156-0pointnull/?status=1079682&type=status

Ctrl+F for "buffy" and you'll see over 80 results. Spot-checking them seems like they're all thumbnail images embedded throughout the page.

If this is the only subdomain appearing in your AV warnings it's either a false positive or a specific file was flagged by Malwarebytes. I have no idea if buffy hosts anything other than images so hard to say whether this is all a false positive or if there is an unsafe embedded file in a page somewhere (from user upload).

Thank you for your help, gotta check out the issue...