« previous next »
Pages: [1]   Go Down

Author Topic: Abuse Yahoo domain IP detected - phishing, c&c, c2, dga - virut  (Read 903 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33568
  • malware fighter
Abuse Yahoo domain IP detected - phishing, c&c, c2, dga - virut
« on: December 15, 2018, 05:43:33 PM »
See: 60 detected domains, 5 contacting malware,
Blacklist timeline: https://www.maltiverse.com/ip/67.195.197.75
Given as malicious: https://www.threatcrowd.org/ip.php?ip=67.195.197.75
Where we saw it flagged for PHISHING ? -> https://urlquery.net/report/c499a7a5-dab3-4499-931a-92e6b3843d7a
and https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=dW5bXW5eXW1wdXR7fS5eXW0%3D~enc
48 recommendations for website: https://webhint.io/scanner/7b03bcf4-53fc-4d17-bd39-afa28719abf1
17 security related: https://webhint.io/scanner/7b03bcf4-53fc-4d17-bd39-afa28719abf1#Security
services mapping is possible from clipart, backgrounds, sidebar to sidebuilder, images - traffic server software ATS/7.1.2
is vulnerable to various input validation  exploits.

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »