Sign in to follow this  
AleksandrSolidMedia

The Iframe in Iframe false positive

Recommended Posts

Hello,

We discovered another possibly suspicious URL: sys.refocus.ru/f1.tyx, which we also
consider to be a false positive.
sys.refocus.ru/f1.tyx is generated as iframe and dynamically inserted
on a webpage by sys.refocus.ru/ra.js script, which we already sent to
you for analysis.

Within this iframe we have another iframe
http://sys.refocus.ru:7070/f2.tyx, [^] and our partner resource is
loaded inside the second iframe ‘f2.tyx’. In this moment you can find
such behavior only on http://anas.kg[^] website (hardcoded only for
this website)

<iframe>
<iframe>
Here goes partner resources
</iframe>
</iframe>

Currently we cooperate only with aidata.me, but we are also going to
cooperate with others like bluekai, visualdna, etc. Partners just
collect audience statistics in order to conduct more precise
advertisement campaigns.

Here is code provided by aidata that is inserted inside the second
iframe.
<img height="1px" width="1px" alt=""
src="http://advombat.ru/0.gif?pid=&id="[^] style="display: none
!important;">


Feel free to contact me, if you require any further information

Best Regards,
Alekander,
Solid Media LLC

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this