Blacklist Incident - Page on markets.financialcontent.com embeds abgewechseltescuaresmar.prosadvice.org

Summary

Correlation: Exact
Matched By: Host
Matched Lists: GSBMalware , RiskIQ
Score: 35
Description: riq.auto EK Angler exploit kit

Incident Details

Id: 86640836
Incident Date: 2014-12-09 04:09 PM PST
Incident Detected Date: 2014-12-10 04:08 PM PST
Cause: iframe.src
Blacklist Resource IP:
Blacklist Resource AS: -
Phishing: false
Scam: false
Malware: true
Spam: false
Alexa Rank: 130715

Matched Lists

GSB Malware Match: prosadvice.org/
Match Type: Domain

ZList Details

ZList ID: 471834
URL: http://abgewechseltescuaresmar.prosadvice.org/x18xenqwe0.php
Match Type: Host
Description: riq.auto EK Angler exploit kit
Score: 75
First Detected At: 2014-12-09 16:23:30.0
First Found On Crawl: 75c29972-a47b-4242-ba24-de78598070ed
First Found On Page: b3d51a79-db3b-44e4-8094-7c3a6661e507
First Found On Resource: e7c81f3c-d9ae-4782-9e04-1c40978e5b02

Blacklist Resource Details

URL: http://abgewechseltescuaresmar.prosadvice.org/anakapweak.php
Sequence: 5
Response Code: 200
Content Type: text/html
Referrer: http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Cause: iframe.src
Location in Prior

Prior Page

Sequence in Crawl: 1
Guid: 42291692-ccd6-47eb-8e4a-852e2c1ae27d
URL: http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
IP Address: 69.28.178.128
Window Name: : TopLevelWindow@58d8f108

Resulting Page

Sequence in Crawl: 8
Guid: a48ee34a-c39e-4165-b286-8448771511dc
URL: http://markets.financialcontent.com/prnews/quote?Symbol=ECR
IP Address: 38.114.159.63
Window Name: : TopLevelWindow@5ccc07c3

Crawl Details

Crawl Guid: f9ec1fae-bc8d-4117-bfe0-5520773b69f5
Crawl Date: 2014-12-09 04:09 PM PST
Frontier URL: http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Metro Code: none
Crawled Pages: 10
Error Pages: 0

Source Search

ID Date Network Type Search Term Metro Pages Entries Crawl Search
359086674 2014-12-09 GoogleNews Organic Higher One, Inc 10 100 View View
Page 8 - Position 79
Oil and Gas Exploration and Production Stocks Coverage -- Gastar ...
http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Gastar Exploration Inc.'s stock declined 9.12%, to close Monday's session at ... trading sessions and the last one month, Gastar Exploration Inc.'s shares ... higher than its three months average volume of 0.88 million shares.
http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html

Sequence Overview

Seq­uence URL Ad Network Cause Response Code Frame Window Parent Window Lost Referrer Referrer
1 http://studio-5.financialcontent.com/prnews?Page=Quote&T... - topLevelRedirect 301 - - : TopLevelWindow@58d8f108 - http://www.prnewswire.com/news...
2 http://markets.financialcontent.com/prnews/quote?Symbol=ECR - redirect 200 true true : TopLevelWindow@5ccc07c3 - http://www.prnewswire.com/news...
3 http://ads.financialcontent.com/www/delivery/ajs.php?zoneid=... - script.src 200 - - : TopLevelWindow@5ccc07c3 - http://markets.financialconten...
4 http://freed.palmspringsalexander.com/bearish/broken/repay/h... - iframe.src 200 true - : FrameWindow@2346470e - http://markets.financialconten...
5 http://abgewechseltescuaresmar.prosadvice.org/anakapweak.php - iframe.src 200 true - : FrameWindow@4a2fef2a - http://freed.palmspringsalexan...

Sequence Details

Prior
Page
http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Window Name: : TopLevelWindow@58d8f108
Link xpath: /*[name()='html']/body/div[4]/main/div[1]/div[2]/div[1]/p[2]/a[4]
Click on Link:

1

http://studio-5.financialcontent.com/prnews?Page=Quote&Ticker=ECR
Referrer: http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Cause: topLevelRedirect
Redirects To :

2

http://markets.financialcontent.com/prnews/quote?Symbol=ECR
Referrer: http://www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Cause: redirect Path from prior: http://markets.financialcontent.com/prnews/quote?Symbol=ECR
Contains Element :

3

http://ads.financialcontent.com/www/delivery/ajs.php?zoneid=2433&cb=51687539827&loc=http%3A//markets.financialcontent.com/prnews/quote%3FSymbol%3DECR&referer=http%3A//www.prnewswire.com/news-releases/oil-and-gas-exploration-and-production-stocks-coverage----gastar-exploration-pioneer-natural-resources-linn-energy-energen-and-eclipse-resources-285206121.html
Referrer: http://markets.financialcontent.com/prnews/quote?Symbol=ECR
Cause: script.src Path from prior: /*[name()='html']/body/div[2]/div[2]/div/div[2]/div[1]/div/span/script[2]/@src
Contains Source :

4

http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Referrer: http://markets.financialcontent.com/prnews/quote?Symbol=ECR
Cause: iframe.src Path from prior: /*[name()='html']/body/iframe[1]/@src
Contains Element :

5

http://abgewechseltescuaresmar.prosadvice.org/anakapweak.php
Referrer: http://freed.palmspringsalexander.com/bearish/broken/repay/header.js
Cause: iframe.src Path from prior: /html/body/iframe/@src