The Iframe in Iframe false positive
We discovered another possibly suspicious URL: sys.refocus.ru/f1.tyx, which we also
consider to be a false positive.
sys.refocus.ru/f1.tyx is generated as iframe and dynamically inserted
on a webpage by sys.refocus.ru/ra.js script, which we already sent to
you for analysis.
Within this iframe we have another iframe
http://sys.refocus.ru:7070/f2.tyx, [^] and our partner resource is
loaded inside the second iframe ‘f2.tyx’. In this moment you can find
such behavior only on http://anas.kg[^] website (hardcoded only for
Here goes partner resources
Currently we cooperate only with aidata.me, but we are also going to
cooperate with others like bluekai, visualdna, etc. Partners just
collect audience statistics in order to conduct more precise
Here is code provided by aidata that is inserted inside the second
<img height="1px" width="1px" alt=""
src="http://advombat.ru/0.gif?pid=&id="[^] style="display: none
Feel free to contact me, if you require any further information
Solid Media LLC
Please sign in to leave a comment.