Possible FP?

[dostafan]

Hello,

to give you little background I work for a company providning livescores websites globally. Recently all banners of 1xbet (online betting provider, longterm partner) started to being blocked by Malwarebytes. They have this domain in common:

f1.cdn.ftd.agency

And this is an example of a full banner code:
 

<script>
    (function(w,d,o,g,r,a,m){
        var cid=(Math.random()*1e17).toString(36);d.write('<div id="'+cid+'"></div>');
        w[r]=w[r]||function(){(w[r+'l']=w[r+'l']||[]).push(arguments)};
        function e(b,w,r){if((w[r+'h']=b.pop())&&!w.ABN){
            var a=d.createElement(o),p=d.getElementsByTagName(o)[0];a.async=1;
            a.src='//cdn.'+w[r+'h']+'/libs/e.js';a.onerror=function(){e(g,w,r)};
            p.parentNode.insertBefore(a,p)}}e(g,w,r);
        w[r](cid,{id:1698718650,domain:w[r+'h']});
    })(window,document,'script',['ftd.agency'],'ABNS');
</script>

Could you please check if false positive?

[JPopovic]

Hello,

This script is potentially malicious:

 http://f1.cdn.ftd.agency/libs/script.20.js 

VT detection:

https://www.virustotal.com/gui/file/6c7fb7122873a01c24e6ecb2d715f01bef806fe8056c100dfb84641368a25bee/detection

 

Please remove it and let us know so we can remove the block.

Thank you!

[dostafan]

Hello Jovan,

Thank you. We got response from the advertiser that this should be fixed now. Can you please re-check?

Best regards,

Jan

[dostafan]

And one more banner code to doublecheck:
 

<script>
    (function(w,d,o,g,r,a,m){
        var cid=(Math.random()*1e17).toString(36);d.write('<div id="'+cid+'"></div>');
        w[r]=w[r]||function(){(w[r+'l']=w[r+'l']||[]).push(arguments)};
        function e(b,w,r){if((w[r+'h']=b.pop())&&!w.ABN){
            var a=d.createElement(o),p=d.getElementsByTagName(o)[0];a.async=1;
            a.src='//cdn.'+w[r+'h']+'/libs/e.js';a.onerror=function(){e(g,w,r)};
            p.parentNode.insertBefore(a,p)}}e(g,w,r);
        w[r](cid,{id:1698718650,domain:w[r+'h']});
    })(window,document,'script',['ftd.agency'],'ABNS');
</script>

 

[JPopovic]

Hello,

The block from the domain (f1.cdn.ftd.agency) will now be removed.

Thank you!