[Tor2web-talk] Fwd: Request received: Questionable content on domain tor2web.org

[Francis Trudeau]

We are tracking that as a Locky payment page.

Abuse.ch also agrees:

https://ransomwaretracker.abuse.ch/host/25z5g623wpqpdwis.onion.to/



On Fri, Apr 1, 2016 at 12:03 PM, Virgil Griffith <i at virgil.gr> wrote:

>
>
> ---------- Forwarded message ----------
> From: *Hover Support* <help at hover.com>
> Date: Saturday, 2 April 2016
> Subject: Request received: Questionable content on domain tor2web.org
> To: Virgil Griffith <i at virgil.gr>
>
>
> ## When replying, please ensure your reply is above this line ##
> [image: Hover] <http://help.hover.com> Customer Service is available: *8am
> to 11pm EST Mon-Fri* and *8am to 8pm EST Sat-Sun*
> No-hold toll free: *1.866.731.6556 <1.866.731.6556>* email:
> *help at hover.com*
>
> You have a new message from Hover!
> Your reference number is #1084535.
>
> [image: Travis Smi]
>
> *Travis Smith* (Hover Help Center)
>
> Apr 1, 13:35
>
> Good afternoon
>
> We have been contacted by the RSA anti-fraud centre in regards to content
> on your domain tor2web.org. This link <
> http://25z5g623wpqpdwis.tor2web.org/> seems to be infected with malware
> and they have requested that the page be removed. It is recommended that
> you contact your hosting provider to have them delete the URL to stop the
> malware.
>
> If you could please take care of this as soon as possible and let me know
> when you have had them delete the url it would be appreciated.
>
> Regards
>
> Travis Smith
> Senior Customer Service Advisor
> Toll-Free: 1-866-731-6556
> International Toll-Free: +1.800.371.69922
>
> To add additional comments, you can simply reply to this email or view
> the request online. <http://help.hover.com/hc/requests/1084535>
> More helpful links:    Blog <http://hover.com/blog>   |   Help & Forums
> <http://help.hover.com/forums>   |   [image: Twitter]
> <http://twitter.com/Hover>   |   [image: Facebook]
> <http://www.facebook.com/Hover>
>
> You have been sent this message because you recently opened a help request
> with Hover.
> [JLR358-27PJ]
>
>
> _______________________________________________
> Tor2web-talk mailing list
> Tor2web-talk at lists.tor2web.org
> https://lists.ghserv.net/mailman/listinfo/tor2web-talk
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ghserv.net/pipermail/tor2web-talk/attachments/20160401/73f00ab4/attachment.html>