thboyd29 Posted October 10, 2018 ID:1274724 Share Posted October 10, 2018 Started getting pop-up flagging this site as a trojan Tuesday, Oct. 9. I had been visiting these sites without incident on a daily basis prior. Attachment 1 shows the report from the first incident encountered. Also getting similar pop-ups from a total of 7 other related sites, as shown in the second attachment. Note that IP addresses aren't the same, but aren't always different, either (the domain name behind them all seem to be securegames.iwin.com) Note also that whenever I visit one of these site, anywhere between 1 and 3 reports are generated per visit. They look identical, except for the port number entry, but I haven't had a hard look at them to see if anything else differs. Were entries for these sites added to Malwarbytes on 10/8 or early 10/9, or perhaps did the sites in question add something that triggered existing Malwarebytes procedures? Please let me know if you need any further information. Thank you. Detnews game trojan report.txt Attachment 1 - Detnews game trojan report.txt Attachment 2 - Other Detnews game sites reporting trojans.txt Link to post Share on other sites More sharing options...
Staff Solution Zynthesist Posted October 10, 2018 Staff Solution ID:1274730 Share Posted October 10, 2018 Hello, Block on *iwin[.]com is for it hosting a PUP on a sub-domain. Link to post Share on other sites More sharing options...
Recommended Posts