See: https://urlquery.net/report/c112d4c2-2baa-4428-b13f-3c37b1c969de
See: https://sitecheck.sucuri.net/results/1nfovox.com
See: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=1nfovox.com&ref_sel=GSP2&ua_sel=ff&fs=1
IDS alert
ET INFO Suspicious HTML Decimal Obfuscated Title - Possible Phishing Landing Apr 19 2017
polonus
This urlencoding abuse still going on, to obfuscate hostnames for PHISHing:
→ https://urlquery.net/report/43f3c2f5-ed51-4247-b70b-6be8abfd731d
Read on this threat: https://isc.sans.edu/forums/diary/Phishers+use+urlencoding+to+obfuscate+hostnames/1342/
On such incidents - analysis: https://www.reverse.it/sample/2cab90664512bc64997042aeaa49080d1f18f030bc1c9973ab5605bc18f71ace?environmentId=100
On Suricata’s IDS alert: http://doc.emergingthreats.net/bin/view/Main/2024228 &
https://www.maltiverse.com/search;query=network_suricata_alert.description:“ET%20INFO%20Suspicious%20HTML%20Decimal%20Obfuscated%20Title%20-%20Possible%20Phishing%20Landing%20Apr%2019%202017”;page=1;sort=query_score
Also consider: http://gigavpn.net/?Page=IpsSignature&My=11M2tUVrpsZisFefjXclCw%3D%3D&SP=38
Site is not active at the mo, but keep an eye on the IP being abused. While this link is above board:
→ https://www.scamadviser.com/check-website/sitepoint.com
polonus (volunteer website security analyst and website error-hunter)
On Punycode attacks: https://www.wandera.com/punycode-attacks/
Mentioned attacks are specially dangerous on the Android platform.
Listed here: https://www.proofpoint.com/us/daily-ruleset-update-summary-20170420
Example: https://urlquery.net/report/43f3c2f5-ed51-4247-b70b-6be8abfd731d
polonus