« previous next »
Pages: [1]   Go Down

Author Topic: Sedoparking redirections suspicious?  (Read 2400 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33937
  • malware fighter
Sedoparking redirections suspicious?
« on: December 25, 2018, 05:29:55 PM »
See: https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=I2wucF1eXSNdXnRdfS5eXW0%3D~enc
parked domain for sale: dom-xss sources and sinks in -http://shebei.labtai.com/link.php?url=http://chungkhoanvn.vn/huong-dan-chi-tiet-ve-chung-khoan-phai-sinh/
Number of sources found: 214 ; number of sinks found: 29
and for : -http://img.sedoparking.com/js/jquery-1.11.3.custom.min.js
Number of sources found: 104 ; number of sinks found: 42
Redirecting to: -https://sarah.runtnc.net/tr?id=018b6f05bc30bb4d6b94e5d014f66e2f84d61f0c3a.r&tk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwdWIiOiI1MjJjNjE1YTlhODQ4MGNhYjhiMTA0MTIiLCJ0cyI6IjEyMjUxNjI0IiwiZCI6InBvY29kb2N0b3IuY29tIn0.0avjtmqUEeWGVpChuBlozieo3g6JV7THJCvmU8veL7I
-> https://aw-snap.info/file-viewer/?protocol=secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=c3x9fGgufXVudG5eLm57dGB0fTxbIz0wMThiNmYwNWJeMzBiYjQjNmI5NHs1IzAxNGY2NnsyZjg0IzYxZjBeM3wufSZ0az17eUpoYkdeW11bSltVelsxTltbc1tufTVeXls2W2twWFZeSjkue3lKdyNXW1tdW1sxTWpKak5qezFZVGxoXSNRNE1HTmhZamhbTVR8ME1UW1tMXkowXnlbNltqe3lNalV4TmpbMFtbd1taXls2W25CdlkyOWtiMk4wYjNbdVkyOXRbbjAuMHx2anRtcVV7e1dHVnBeaHVCbF16W3tdM2c2SlY3VEhKXnZtVTh2e0w3Ww%3D%3D~enc
Compare: -http://www.bonniej.com/__media__/js/netsoltrademark.php?d=edemocracia.camara.leg.br%2Fexpressao%2Ft%2Fo-que-voces-acham-de-ensino-a-distancia%2F59659%2F3%3Fu%3Ddiegoo
Number of sources found: 8 ; number of sinks found: 13
and tracker script from: -https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js
a malsite? -> https://www.virustotal.com/pl/url/7d88e51f269a839acdcc048bb79f3354f241577572be397546d0243ea4023d8e/analysis/1545755279/
Go-Daddy additional monitoring script added! Background read: https://wallydavid.com/remove-godaddys-broken-monitoring-script-added/ (info credits go there!).

polonus (volunteer website security analyst and website error-hunter)
« Last Edit: December 25, 2018, 05:32:13 PM by polonus »
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »