Web attack

ankspon

I had an attempt blocked by Norton from Petersburg internet network in Belgium,IP adress is 37.9.61.165.Do you know what this is and how they try to attack you so i can keep away from it please.
The report says network traffic from tima.cyl.me/in.cgi!?2

paddyrg

Automated attacks like these happen the whole time, keep your firewall on and up-to-date and you should be fine.

It's nothing you've done or can avoid.

waddler_8

Rather strangely, that particular webpage just gives:

"End Of The World"

Everyone came around here
Everyone else got sick
And watched the clock tickin' slowly
Everyone knew the ending
Opened a bag of tricks
And stumbled over their own
They blew minds away
Sort of the cripplin just like thunder
And it's gone today
I'm so happy that it's on

It's the end of the world

Well it's far away
In a hurricane, twisting slowly
Now it's gone today
I'm so happy that it's on

It's the end of the world

My world, my love, my gun

Now I'm all alone
Kept the pain inside
Wanna torch the world
Cause I'm breathin fire

My world, my love, my gun

That IP actually blocked by malwarebytes' IP protection too.

Out of interest, what site were you browsing when Norton gave the alert?

ankspon

I am unsure which page it was,i run Mbam and it did not find anything

johnmc

http://www.speedguide.net/ip/37.9.61.165#_

inetnum: 37.9.61.0 - 37.9.61.255
netname: besthosting-net
descr: net for besthosting solution
country: BE
admin-c: MA12532-RIPE
tech-c: MA12532-RIPE
status: ASSIGNED PA
mnt-by: MNT-PIN
source: RIPE # Filtered

person: Mihailov Andrey
address: Minsk, Republic of Belarus, Molchanov str. 41/52
phone: + 375-29-235-41-55
nic-hdl: MA12532-RIPE
mnt-by: besthost-MNT
source: RIPE # Filtered


route: 37.9.61.0/24
descr: PINROUTE
origin: as44050
mnt-by: MNT-PIN
source: RIPE # Filtered

You could always pay him a visit or phone him ................

Gillor

Virus Total is indicating this site is clean and nothing is showing on Malware Domain List so could be a false positive, especially as these are the lyrics to the track End of the World by a group called Cold.

http://www.youtube.com/watch?v=x8tvqOF3dhU&ob=av2e

waddler_8

Whilst it may not be malicious at the moment , looking at the primary domain there looks to be reason to block it.

http://www.google.com/safebrowsing/diagnostic?site=cyl.me

There been interest in a few of the tim*.cyl.me sub-domains by the looks of it.

http://jsunpack.jeek.org/dec/go?report=95831ccfd731ccc4b44f46d3572f078e3e6a5da7
http://jsunpack.jeek.org/dec/go?report=51f3a59709785248a72cb2decf50390f4568fe98
http://jsunpack.jeek.org/?report=04832128b54165946ee09e3c12c70eafa700978d

Another sub-domain (andaz.cyl.me) serving a trojan:js/redirector variant.

http://www.google.com/safebrowsing/diagnostic?site=andaz.cyl.me

http://www.scumware.org/report/146.185.254.42

Gillor

As most conventional signature-based anti virus software is not picking this up, this surely re-inforces the need a for multi-layered approach to internet security.

A good case for something like Sandboxie and NoScript?

ankspon

Good old Norton

waddler_8

ankspon wrote: »

Good old Norton

Indeed - not very often you hear that!

Just make sure any installed programs are up to date, leaving nothing that may be open to exploit.

http://secunia.com/products/consumer/osi/online/

Probi

waddler_8 wrote: »

http://jsunpack.jeek.org/dec/go?report=95831ccfd731ccc4b44f46d3572f078e3e6a5da7
http://jsunpack.jeek.org/dec/go?report=51f3a59709785248a72cb2decf50390f4568fe98
http://jsunpack.jeek.org/?report=04832128b54165946ee09e3c12c70eafa700978d

These 3 throw up warning in Avast for me, never seen it do it before so nice to know it works!