Avast WEBforum

Other => Viruses and worms => Topic started by: polonus on May 30, 2020, 05:42:35 PM

Title: Redirecting to malware?
Post by: polonus on May 30, 2020, 05:42:35 PM

Only one engine to detect.
URL -hXtps://whitehalfolk dot club/WXWUZ?tag_id=872156&sub_id1=056bcfab755978db41daf298befc902a&sub_id2=3245140778404036668&cookie_id=8c05c353-8ec8-486f-8215-8a779884db7c&lp=loading&tb=redirect&allb=redirect&ob=redirect&href=htxps%3A%2F%2Fnscollectureob dot info%2F%3Ftid%3D872157%26noocp%3D1%26subid%3D056bcfab755978db41daf298befc902a&hop=7&geo=XY

Re: https://www.virustotal.com/gui/url/1636f1149dce13d2d63e15b518783ba1af75ee9db852fb373e8df40c9157c0f3/details
On IP relations: https://www.virustotal.com/gui/ip-address/52.206.71.220/relations

This is Outbrain's Ad virus Browser Hijacker - because in the code we see "replaceOutbrainPolicy"

polonus

Title: Re: Redirecting to malware?
Post by: polonus on May 30, 2020, 06:06:22 PM

Domain blacklisted by McAfee: htxps://whitehalfolk.club/WXWUZ?tag_id=872156&sub_id1=056bcfab755978db41daf298befc902a&sub_id2=3245140778404036668&cookie_id=8c05c353-8ec8-486f-8215-8a779884db7c&lp=loading&tb=redirect&allb=redirect&ob=redirect&href=hxtps://nscollectureob.info/?tid=872157&noocp=1&subid=056bcfab755978db41daf298befc902a&hop=7&geo=XY
according to https://sitecheck.sucuri.net/results/

fakeposters -> http://all.domains-register.com/www.nscollectureob.info

No information on this domain: http://all.domains-register.com/index.php?siteinfo=whitehalfolk.club

pol