Ad/referral to Accor hotels website triggers block

Viruses and worms
1

If you google for Accor hotels and click the sponsored link on the top openDNS will block the redirect because domain “logp3 xiti com” has been qualified as adware. The same happens when you click a link coming from a price-comparing site like Zoover or Pricejet.

Scanning that url at quttera does not result in any hits. Also the blacklist status is not listed. The site of Accor hotels hxxp://www.accorhotels.com does raise a bunch of warnings though: http://quttera.com/detailed_report/accorhotels.com

Visiting the accor site directly does not result in a block by openDNS however. Strange?

2

site is down. http://urlquery.net/report.php?id=9138197
IP is on one blacklist here. http://whatismyipaddress.com/blacklist-check

3

See the low confidence rep here: https://www.mywot.com/en/scorecard/logp3.xiti.com?utm_source=addon&utm_content=popup-donuts

pol

4

It seems the logp3 site is an ad referral tracking service, it tracks user activity. It might be one of those dynamic pricing methods that change the price based on things like the number of times someone returns (comparing prices/offers and not finding anything cheaper/better), time spent looking at the offer (doubting).

The apenews.org blocks a lot but the site doesn’t seem to have been updated since 2011…

5

Hi propheticus,

Also consider: http://www.malwaregroup.com/domains/details/logp3.xiti.com
But it seems what has been flagged as being malware from there, is now dead and ancient history (2012-11-13): http://support.clean-mx.de/clean-mx/viruses.php?review=62.161.94.221&sort=firstseen%20desc
And here you see that your evaluation is dead-on :smiley: (The specified type of tracerouting is allowed for superuser only → followed a bug report abuse)
→ /usr/bin/lft: Option wrapper probe…see the logs here: http://support.clean-mx.de/clean-mx/view_virusescontent.php?url=http%3A%2F%2Flogi125.xiti.com

polonus