Reply to thread

Message

<blockquote data-quote="Prorootect" data-source="post: 714581" data-attributes="member: 905"><a href="https://twitter.com/bad_packets" target="_blank">Bad Packets Report‏ @bad_packets</a> - <a href="https://twitter.com/bad_packets/status/967864119230586880" target="_blank">Bad Packets Report on Twitter</a><a href="https://twitter.com/hashtag/Coinhive?src=hash" target="_blank">#Coinhive</a> found on the website of Mexican professional football league <a href="https://twitter.com/AscensoMX" target="_blank">@AscensoMX</a>. This case of <a href="https://twitter.com/hashtag/cryptojacking?src=hash" target="_blank">#cryptojacking</a> appears to be caused by an open AWS S3 bucket as the malicious script is injected via <a href="http://s3.amazonaws[.]com/lmxwebsite/js/toastr.js" target="_blank">http://s3.amazonaws[.]com/lmxwebsite/js/toastr.js</a><img src="https://pbs.twimg.com/media/DW6KjgCVAAEAUvy.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" />&nbsp;<img src="https://pbs.twimg.com/media/DW6KnCbVoAAVgtD.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /><img src="https://pbs.twimg.com/media/DW6K6uXUQAEfZ4s.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /><img src="https://pbs.twimg.com/media/DW6LFRcVoAE4UJb.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" />12:49 PM - 25 Feb 2018-------------------------------------------toastr.js VirusTotal:<a href="https://www.virustotal.com/de/file/a9a41e1452f3aa291a59b13ad7e80ea4322f9854e6df47be624faed692b9b991/analysis/1519592076/" target="_blank">Antivirus scan for a9a41e1452f3aa291a59b13ad7e80ea4322f9854e6df47be624faed692b9b991 at 2018-02-25 20:54:36 UTC - VirusTotal</a>- on hxxp://ascensomx.net/ I have 60-90%CPU load today...so beware</blockquote>

[QUOTE="Prorootect, post: 714581, member: 905"] [URL='https://twitter.com/bad_packets'][B]Bad Packets Report[/B]‏ @bad_packets[/URL] - [URL="https://twitter.com/bad_packets/status/967864119230586880"]Bad Packets Report on Twitter[/URL] [URL='https://twitter.com/hashtag/Coinhive?src=hash']#Coinhive[/URL] found on the website of Mexican professional football league [URL='https://twitter.com/AscensoMX']@AscensoMX[/URL]. This case of [URL='https://twitter.com/hashtag/cryptojacking?src=hash']#cryptojacking[/URL] appears to be caused by an open AWS S3 bucket as the malicious script is injected via [URL]http://s3.amazonaws[.]com/lmxwebsite/js/toastr.js[/URL] [IMG]https://pbs.twimg.com/media/DW6KjgCVAAEAUvy.jpg[/IMG] [IMG]https://pbs.twimg.com/media/DW6KnCbVoAAVgtD.jpg[/IMG] [IMG]https://pbs.twimg.com/media/DW6K6uXUQAEfZ4s.jpg[/IMG] [IMG]https://pbs.twimg.com/media/DW6LFRcVoAE4UJb.jpg[/IMG] 12:49 PM - 25 Feb 2018 ------------------------------------------- toastr.js VirusTotal: [URL='https://www.virustotal.com/de/file/a9a41e1452f3aa291a59b13ad7e80ea4322f9854e6df47be624faed692b9b991/analysis/1519592076/']Antivirus scan for a9a41e1452f3aa291a59b13ad7e80ea4322f9854e6df47be624faed692b9b991 at 2018-02-25 20:54:36 UTC - VirusTotal[/URL] - on hxxp://ascensomx.net/ I have 60-90%CPU load today...so beware [/QUOTE]

Verification