Jump to content

IP address 54.239.172.17 and others, from apps.detnews.com.*


thboyd29
Go to solution Solved by Zynthesist,

Recommended Posts

Started getting pop-up flagging this site as a trojan Tuesday, Oct. 9.  I had been visiting these sites without incident on a daily basis prior.

Attachment 1 shows the report from the first incident encountered.

Also getting similar pop-ups from a total of 7 other related sites, as shown in the second attachment.

Note that IP addresses aren't the same, but aren't always different, either (the domain name behind them all seem to be securegames.iwin.com)

Note also that whenever I visit one of these site, anywhere between 1 and 3 reports are generated per visit.  They look identical, except for the port number entry, but I haven't had a hard look at them to see if anything else differs.

Were entries for these sites added to Malwarbytes on 10/8 or early 10/9, or perhaps did the sites in question add something that triggered existing Malwarebytes procedures?

Please let me know if you need any further information.

Thank you.

Detnews game trojan report.txt

Attachment 1 - Detnews game trojan report.txt

Attachment 2 - Other Detnews game sites reporting trojans.txt

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.