favicon.ico block by avast

mchain · 2017-04-02T20:44:06.000Z

IP address reported: 209.141.56.34

https://cymon.io/209.141.56.34 Two domains found.
VT report: https://www.virustotal.com/en/url/d9b300d9784d21d4d3dbb2a925afd825f57674a46ae277f62c872ed13bd4d501/analysis/1491164558/
zulu: http://zulu.zscaler.com/submission/show/77c206a0e6e5248d9330d08046c2db9b-1491163721
urlquery: http://urlquery.net/report.php?id=1491162966941
VT Domain report: http://urlquery.net/report.php?id=1491162966941
quterra: https://quttera.com/detailed_report/all.the.cyberz.com
Sucuri: https://sitecheck.sucuri.net/results/all.the.cyberz.com
VT report: https://www.virustotal.com/en/url/007917a022e35a27b4fc287509a925dde321a3fa80533e4c71a3a4f7ebfb10d7/analysis/1491164243/
zulu: http://zulu.zscaler.com/submission/show/b9e4a472b147860f0dec459e1658e4a3-1491164087
urlquery: http://urlquery.net/report.php?id=1491164534669
quterra: https://quttera.com/detailed_report/sameid.net
Sucuri: https://sitecheck.sucuri.net/results/sameid.net
VT report on IP: https://www.virustotal.com/en/url/d9b300d9784d21d4d3dbb2a925afd825f57674a46ae277f62c872ed13bd4d501/analysis/1491164558/

Seems a hidden redirect that was never completed to paypal.com

polonus · 2017-04-02T21:26:57.000Z

Hi mchain,

And as you can see from the scan results here, it is all in the cloud: http://retire.insecurity.today/#!/scan/39caa22316339c9917d39fe4a57d552e05e681bad57ae17b87fe58de041e8410

Affecting compiled.js: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fd3mwhxgzltpnyp.cloudfront.net%2Flocal-storage%2Fjstorage.js = Malware…

See: https://www.virustotal.com/pl/url/568140e9c1009c7cb645f122c0a2f4c9c36ef89908aacff01f57af7bcc032bc4/analysis/1491168067/

and: http://toolbar.netcraft.com/site_report?url=+209.141.56.34 or
https://urlscan.io/result/c442d573-02f8-4257-8807-7fca9d750053#summary
and: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=209.141.56.34%2F&ref_sel=GSP2&ua_sel=ff&fs=1

Excessive server info proliferation: nginx/1.0.15 OpenSSH 5.3 (protocol 2.0) exploitable

F-status: https://observatory.mozilla.org/analyze.html?host=sameid.net

polonus (volunteer website security analyst and website error-hunter)

Announcements