Avast WEBforum

Other => Viruses and worms => Topic started by: polonus on December 02, 2019, 05:17:36 PM

Title: Parasitic traffic on 162.241.225.33 - host with many vulnerabilities...
Post by: polonus on December 02, 2019, 05:17:36 PM

Since 2015 on a malware domain list: https://quttera.com/detailed_report/2amsports.com
generated with Word 14 see: code: https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=Mnxtc3BdfXRzLl5dbQ%3D%3D~enc
All vuln. at the racks of East Provo, Netcraft threat risk rate 7 red out of 10:
https://toolbar.netcraft.com/site_report?url=box5233.bluehost.com

See for OpenSSH vulnerabilities, exploitable flaws: https://www.shodan.io/host/162.241.225.33

Malware at their wires on that IP: https://www.virustotal.com/gui/ip-address/162.241.225.33/relations
For that specific domain: https://www.virustotal.com/gui/url/15094ecddc34a5fb5a801f38ddce0ad3a2b2e3690c8088d0b0962ee6e2dc0647/detection
4 years ago had a -9 qualification.

polonus

Title: Re: Parasitic traffic on 162.241.225.33 - host with many vulnerabilities...
Post by: polonus on November 15, 2020, 03:09:15 PM

Update: website is still to be found on this domain blacklist:
https://github.com/austinheap/sophos-xg-block-lists/blob/master/malware-domain-list.txt
see: https://www.virustotal.com/gui/url/15094ecddc34a5fb5a801f38ddce0ad3a2b2e3690c8088d0b0962ee6e2dc0647/detection
Re: https://sitecheck.sucuri.net/results/2amsports.com
IP detection: https://www.abuseipdb.com/check/162.241.225.33

polonus