80.74.152.50 - Compromised

[SI-Solutions_GmbH]

URL-Being blocked: hxxps://youvita-thurgau.ch

Added Exclusion to Threatdown, but the Endpoints don't seem to care once again.

Added the IP 80.74.152.50 as well as hxxps://youvita-thurgau.ch and youvita-thurgau.ch to the exclusion.

I talked to the Website Designer/Programmer he did a troughout check trough the Web-Page and Wordpress, and didn't find anything suspicious.

Looking up the  RIPE of the IP shows it's from Metanet, a Swiss Hostingprovider. So it's highly likely that this is a multi-host IP that at some point, or currently is hosting some kind of Compromised website. If it currently hosting some kind of mailicous content it's clear that the IP stays blocked, but then i'd at least love if the exclusion feature actually worked.

inetnum:        80.74.152.0 - 80.74.152.127
netname:        METANET
descr:          METANET AG, Switzerland
remarks:        INFRA-AW
country:        CH
admin-c:        PWS22-RIPE
tech-c:         MWS22-RIPE
status:         ASSIGNED PA
notify:         
mnt-by:         META-NET
mnt-lower:      META-NET
mnt-routes:     META-NET
created:        2008-09-09T14:29:30Z
last-modified:  2008-09-09T14:29:30Z
source:         RIPE

_____________________________

Threat Name:	Compromised
Action Taken:	blocked
Category:	Website
Scanned At:	04/22/2024 9:04:55 AM
Reported At:	04/22/2024 9:04:05 AM
Process Name:	C:\Program Files\Mozilla Firefox\firefox.exe
Type:	Outbound Connection
Endpoint:	[Censored]
Domain:	youvita-thurgau.ch
Group Name:	[Censored]
IP Address:	80.74.152.50
Port:	443

[JPopovic]

Hello,

The block will be removed.

Thank you!