For the last few days I have been getting my antivirus blocking some attacks from the above IP when clicking on some posts in the last 24 hour list.

 

This happens about one time in 10 and does not happen anywhere else.

 

 

It is the public ip of a authoritative router/server which hosts a number of domains. It is registered in germany to Hetzner Online AG https://www.hetzner.de/en/

 

lb1.docoloc.de/ bringmeupins.com diminicolisa.com combaniali.com hightringo.com dextrinial.com

Still hoping for an answer here from the site heirachy.

 

If I block this IP in internet explorer I can't get to SF at all.

What happens when you switch to Firefox or another browser ?

I don't have another browser.

http://www.malware-traffic-analysis.net/2015/09/14/index.html

 

this talks a little bit about it. Looks like the normal shenanigans. Infect, blackmail to decrypt.

Thanks a bundle Endy, I will investigate this further. +1

 

I note that the IP is listed along with some more.

 

Others beware. The IP is a gateway and some ill intentioned users hide behind random letters as in my screenshot.

Edited October 14, 201510 yr by studiot