Harmful advertisement in old photo management website domain?

system · 2015-10-08T11:50:01.000Z

Uh, hello, it’s me again…

Last evening I desided to quickly check out some of my Google Chrome bookmarks which were exported from my Firefox, and it had some links I hadn’t used for a long time. One of them was domain called “pics.picmv.com”, which I remember being photo website I used to visit before, but when I clicked the link, it seemed to redirect me into some kind of advertisement site hosted by “dailyprizedraw.com”, which gave me finnish Chrome popup offering free iPhone 6. I managed to close the popup quickly and the site itself seemed to have some kind of inquiry regarding my personal usage of Apple products. I’m aware of internet being full of these kind of commercial popups all aroun the internet which nowadays can get pass Adblock if the domain host has payed them (I have Adblock installed on my Chrome), but I felt little weird the advertisement redirect popping up in the old domain that used to be a photo management website which I remember newer having problems with. Avast didn’t show any alerts.

I Googled “pics.picmv.com” and the first link that has the domain in it says it might be for sale, so I quess the page has closed down, which might also be why I had removed it from my Firefox boomarks, I don’t remember correctly.

I had no time to get into this right away since it was just a short time before I had to go to bed, but I pitched whole advertisement link into Virustotal and it seemed to be hosted by Amazon. ???

https://www.virustotal.com/en/url/ed3def058ec438b5a04f1330b207a237bb6b0c45215af7bad4e6424b5686592f/analysis/1444303093/

polonus · 2015-10-08T14:36:38.000Z

It has a unique tracking ID and it is redirected via a parking site.
See: -http://parkingcrew.net/assets/scripts/js3.js and
giving you all kind of ads: -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fparkingcrew.net%2Fassets%2Fscripts%2Fjs3.js
landing here: http://toolbar.netcraft.com/site_report?url=http://gsa-online.de
→ alerts > http://urlquery.net/report.php?id=1439863719511

polonus

system · 2015-10-08T15:03:47.000Z

I noticed “ET POLICY PE EXE or DLL Windows file download” under “Intrusion Detection Systems”. Can someone clarify what it means?

system · 2015-10-08T16:08:26.000Z

I hope this isn’t getting irritating, and also hope you don’t judge me for my paranomia, but I went and made new scan logs to see if I managed to cought anything strange. After this I’ll try be much more careful on the web… :-[

Pondus · 2015-10-08T16:27:21.000Z

Pernaman post:3:

I noticed “ET POLICY PE EXE or DLL Windows file download” under “Intrusion Detection Systems”. Can someone clarify what it means?

Google is your friend

Suricata rules listed here https://github.com/jflsakfja/suricata-rules/blob/master/list.txt

Announcements