2

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline.

[WARNING: ACCESS IN A CONTROLLED ENVIRONMENT]

http://yt-news.info/s/?id=qlktvqt46220jr8q6

Here's the link bait as a news on facebook https://facebook.com/290091591171980

What's happening? .pnh files seems to be related with Adobe. And in this case it seems like a visit counter. Not sure if it offers any harm. However, following the the url facebook offers did triggers some anti-virus softwares.

Is this a XSS attack? Or just a simple redirect with this unknown .pnh?

EDIT:

This extension interfaces with http://whos.amung.us. If you use their widget on your website, the extension gets how many users are on your website and puts the count in your status bar. To configure this after it has been installed, open up the addons list from the Firefox menu, click on this addon, click options, and enter your 8-12 character key which is found in the html you were given. Ie: the image name, without the '.png' part, it's pretty self explanatory. Close options, and soon thereafter your user count will be updated in real time :)

https://addons.mozilla.org/en-US/firefox/addon/whosamungus-users-online-count/

It seems like it's a phishing attempt:

http://viewtubes.info/bebadas/chrome.html

  • The yt-news.info site seems to not work any more. See: 130 ;( eric@crunchbang ~ $ wget http://yt-news.info/s/?id=qlktvqt46220jr8q6 --2014-07-06 00:13:33-- http://yt-news.info/s/?id=qlktvqt46220jr8q6 Resolving yt-news.info (yt-news.info)... 37.0.123.217 Connecting to yt-news.info (yt-news.info)|37.0.123.217|:80... failed: Connection timed out. Retrying. – Eric Lagergren Jul 6 '14 at 7:15
  • @eric_lagergren The redirection changes depending on the brownser. That's the reason you can't download it. Be sure to access the full url too. – user4610 Jul 6 '14 at 7:23
  • Anyway, I think that's a script kiddie... – user4610 Jul 6 '14 at 7:25
  • It times out in both Chrome and Firefox. The Facebook link prompts me to download an .html file that contains a JS redirection to the http://yt-news.info... website. – Eric Lagergren Jul 6 '14 at 7:26
  • @eric_lagergren Not sure maybe there's a block by IP location. Here's up (Brazil). The download on facebook it's meant to people to download and open in their browsers. – user4610 Jul 6 '14 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy