AleksandrSolidMedia

Members
  • Content Count

    1
  • Joined

  • Last visited

Community Reputation

0 Neutral

About AleksandrSolidMedia

  • Rank
    Newbie
  1. Hello, We discovered another possibly suspicious URL: sys.refocus.ru/f1.tyx, which we also consider to be a false positive. sys.refocus.ru/f1.tyx is generated as iframe and dynamically inserted on a webpage by sys.refocus.ru/ra.js script, which we already sent to you for analysis. Within this iframe we have another iframe http://sys.refocus.ru:7070/f2.tyx, [^] and our partner resource is loaded inside the second iframe ‘f2.tyx’. In this moment you can find such behavior only on http://anas.kg[^] website (hardcoded only for this website) <iframe> <iframe> Here goes partner resources </iframe> </iframe> Currently we cooperate only with aidata.me, but we are also going to cooperate with others like bluekai, visualdna, etc. Partners just collect audience statistics in order to conduct more precise advertisement campaigns. Here is code provided by aidata that is inserted inside the second iframe. <img height="1px" width="1px" alt="" src="http://advombat.ru/0.gif?pid=&id="[^] style="display: none !important;"> Feel free to contact me, if you require any further information Best Regards, Alekander, Solid Media LLC