Blacklist Incident - Page on www.newschannel6now.com embeds sijyuu-patition.thefinal-whistle.com

Summary

Correlation: Exact
Matched By: Url
Matched Lists: GSBMalware , RiskIQ
Score: 35
Description: riq.auto EK Angler exploit kit

Incident Details

Id: 86399014
Incident Date: 2014-12-09 03:57 PM PST
Incident Detected Date: 2014-12-09 04:07 PM PST
Cause: iframe.src
Blacklist Resource IP: 178.32.193.221
Blacklist Resource AS: AS16276: Country: FR  Registry: ripencc
OVH , FR
Phishing: false
Scam: false
Malware: true
Spam: false
Alexa Rank: 486621

Matched Lists

GSB Malware Match: thefinal-whistle.com/
Match Type: Domain

ZList Details

ZList ID: 471822
URL: http://sijyuu-patition.thefinal-whistle.com/m1bvtxeq92.php
Match Type: Url
Description: riq.auto EK Angler exploit kit
Score: 75
First Detected At: 2014-12-09 16:06:20.0
First Found On Crawl: 501d7c94-2f23-455a-a72a-6ecffab12072
First Found On Page: 840900a2-1398-4ecd-8ea5-70d6816c45c3
First Found On Resource: 54e467e4-17a5-4004-84b5-3ee3ca262058

Blacklist Resource Details

URL: http://sijyuu-patition.thefinal-whistle.com/m1bvtxeq92.php
Sequence: 5
Response Code: 200
Content Type: text/html
Referrer: http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Cause: iframe.src
Location in Prior

Prior Page

Sequence in Crawl: 1
Guid: 85ab0d05-8bd2-4186-bd46-ff9bceb8c0cd
URL: http://www.newswest9.com/story/27571769/penalty-phase-begins-for-ex-texas-justice-of-peace
IP Address: 23.67.247.217
Window Name: : TopLevelWindow@35d0e08f

Resulting Page

Sequence in Crawl: 10
Guid: 840900a2-1398-4ecd-8ea5-70d6816c45c3
URL: http://www.newschannel6now.com/
IP Address: 23.67.247.59
Window Name: : TopLevelWindow@35d0e08f

Crawl Details

Crawl Guid: 501d7c94-2f23-455a-a72a-6ecffab12072
Crawl Date: 2014-12-09 03:57 PM PST
Frontier URL: http://kwes.com/story/27571769/penalty-phase-begins-for-ex-texas-justice-of-peace
Metro Code: none
Crawled Pages: 10
Error Pages: 0

Source Search

ID Date Network Type Search Term Metro Pages Entries Crawl Search
359084888 2014-12-09 RiskIQ Blog Dana Coco Williams convicted 1 255 none View
Page 2 - Position 28
Penalty phase begins for ex-Texas justice of peace - KWES NewsWest 9 / Midland, Odessa, Big Spring, TX: newswest9.com |
Penalty phase begins for ex-Texas justice of peace ROCKWALL, Texas (AP) - Jurors in North Texas will consider life in prison or the death penalty for a former justice of the peace convicted of killing a prosecutor's wife. The punishment phase begins Monda
http://www.newswest9.com/story/27571769/penalty-phase-begins-for-ex-texas-justice-of-peace

Sequence Overview

Seq­uence URL Ad Network Cause Response Code Frame Window Parent Window Lost Referrer Referrer
1 http://www.newschannel6now.com/ - parentPage 200 true true : TopLevelWindow@35d0e08f - http://www.newswest9.com/story...
2 http://studio-5.financialcontent.com/worldnow?Module=snapsho... - script.src 200 - - : TopLevelWindow@35d0e08f - http://www.newschannel6now.com...
3 http://ads.financialcontent.com/www/delivery/afr.php?n=fcad9... - iframe.src 200 true - fcad9123148: FrameWindow@2647... - http://www.newschannel6now.com...
4 http://freed.palmspringsalexander.com/bearish/broken/repay/h... - iframe.src 200 true - : FrameWindow@9739d1e - http://ads.financialcontent.co...
5 http://sijyuu-patition.thefinal-whistle.com/m1bvtxeq92.php - iframe.src 200 true - : FrameWindow@4afc149e - http://freed.palmspringsalexan...

Sequence Details

Prior
Page
http://www.newswest9.com/story/27571769/penalty-phase-begins-for-ex-texas-justice-of-peace
Window Name: : TopLevelWindow@35d0e08f
Link xpath: /html/body/div[5]/div[1]/div[1]/table/tbody/tr/td[2]/div/div/div[1]/div[2]/div[4]/ul[3]/li[4]/a
Click on Link:

1

http://www.newschannel6now.com/
Referrer: http://www.newswest9.com/story/27571769/penalty-phase-begins-for-ex-texas-justice-of-peace#
Cause: parentPage
Contains Element :

2

http://studio-5.financialcontent.com/worldnow?Module=snapshot&OutputMode=JS
Referrer: http://www.newschannel6now.com/
Cause: script.src Path from prior: /html/body/div[4]/div[2]/div/div[3]/div[14]/div/div[3]/table/tbody/tr/td/div/script/@src
Contains Source :

3

http://ads.financialcontent.com/www/delivery/afr.php?n=fcad9123148&&zoneid=1311&cb=fcad9123148
Referrer: http://www.newschannel6now.com/
Cause: iframe.src Path from prior: /html/body/div[4]/div[2]/div/div[3]/div[14]/div/div[3]/table/tbody/tr/td/div/div/div[3]/iframe/@src
Contains Element :

4

http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Referrer: http://ads.financialcontent.com/www/delivery/afr.php?n=fcad9123148&&zoneid=1311&cb=fcad9123148
Cause: iframe.src Path from prior: /*[name()='html']/body/iframe[1]/@src
Contains Element :

5

http://sijyuu-patition.thefinal-whistle.com/m1bvtxeq92.php
Referrer: http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Cause: iframe.src Path from prior: /html/body/iframe/@src