Author Topic: Malicous site on abuse IP?  (Read 740 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33986
  • malware fighter
Malicous site on abuse IP?
« on: September 20, 2023, 01:40:34 PM »
See: https://www.virustotal.com/gui/url/05236cd7d550be467b112c534be00c0a05b2a1984996579ce89f70ef9583c7bf/details
and https://www.abuseipdb.com/check/45.133.44.24
Coulkd well be abuse perdormed on a parked site: Status codes
These should normally all be the same.

Google Chrome returned code 301 to -https://na.nawpush.com/
GoogleBot returned code 301 to -https://na.nawpush.com/

See: https://en.internet.nl/site/na.nawpush.com/2342793/

polonus
« Last Edit: September 20, 2023, 01:50:42 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33986
  • malware fighter
Re: Malicous site on abuse IP?
« Reply #1 on: September 21, 2023, 11:27:35 AM »
See vulnerability here: https://www.shodan.io/host/45.133.44.25
-na.nawpush.com
       45.133.44.25
ADVANCEDHOSTERS-AS
United States

Quote
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
info source -> hackertarget dot com.

pol
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!