Not Detected

BeSecure · 2015-10-15T16:06:37.000Z

hxxp://www.tr.im/M2q1M/
https://www.virustotal.com/en/url/7c268f5afaac1c62a693d1a5f6a03d2212123d581d0871bbee440d81df87c0e5/analysis/1444922532/

uBlock Origin has prevented the following page from loading:hxxp://lechequeservice.com/nailas/hotiehotie/Verification%20Set-up.html
Found in: Malware domains
Not blocked by AOS.http://quttera.com/sitescan/www.tr.im

A known PHISH, that is not blocked → http://blog.gmane.org/gmane.comp.security.phishings
Post it as not detected. Abuse on Amazon. This is confirming your post: http://urlquery.net/report.php?id=1444923447311 nailas/hotiehotie/Verification%20Set-up_files/EN-US1_data/bk-coretag.js HTTP/1.1 seems taken down now. But the phishing goes on from IP 192.185.3.213 - clear that this is a threat with a 10 red out of 10 red website risk score at http://toolbar.netcraft.com/site_report?url=http://192.185.3.213
Server there with version 1.8.0 without patch horizon-nginx-rpm- is exploitable!

polonus · 2015-10-15T17:21:20.000Z

Good find, Be Secure, good find. Checked it against two online cheks and they came up with the following:

With an iFrame check this came up: Suspicious

verification%20set-up_files/en-us1.html’
verification%20set-up_files/en-us.html’ (PHP /VerificationSetUp.html, part of a PHISH!)

The Javascript check flags this: uspicious

le=“width: 475px;”><iframe id=“i0278” marginheight=“0px” marginwidth=“0px” scrolling=“no” src=“verification%20set-up_files/en-us1.html” fram…

Oh and confirmed for IP, threat distribution 100% → https://www.reasoncoresecurity.com/ip-address-54.165.60.202.aspx

What’s spread from that IP:
Files
The IP address has been seen to host the following 3 files.
Threat.InstallMonster.DIREKTTUR (Medium)kerish doctor 2015 4.exe
PUP.iDatixCorporation.Installer (Medium)registrycleanersetup.exe
PUP.OOOSoftMedia (Medium)sdformatter3_1.rar.exe

Downloads
File URLs download from 54.165.60.202.
Threat.InstallMonster.DIREKTTUR (Medium)-http://tr.im/o21 (kerish doctor 2015 4.exe) *
PUP.iDatixCorporation.Installer (Medium)-http://tr.im/o44 (registrycleanersetup.exe) *
PUP.OOOSoftMedia (Medium)-http://tr.im/4t2dz (sdformatter3_1.rar.exe) *

and should be added to detection…

polonus

Announcements