{"action":"opened","issue":{"url":"https://api.github.com/repos/gorhill/uBlock/issues/2128","repository_url":"https://api.github.com/repos/gorhill/uBlock","labels_url":"https://api.github.com/repos/gorhill/uBlock/issues/2128/labels{/name}","comments_url":"https://api.github.com/repos/gorhill/uBlock/issues/2128/comments","events_url":"https://api.github.com/repos/gorhill/uBlock/issues/2128/events","html_url":"https://github.com/gorhill/uBlock/issues/2128","id":187505247,"number":2128,"title":"pgl.yoyo.org is blacklisted as an active Dridex trojan horse command & control server","user":{"login":"tiguchi","id":6569525,"avatar_url":"https://avatars.githubusercontent.com/u/6569525?v=3","gravatar_id":"","url":"https://api.github.com/users/tiguchi","html_url":"https://github.com/tiguchi","followers_url":"https://api.github.com/users/tiguchi/followers","following_url":"https://api.github.com/users/tiguchi/following{/other_user}","gists_url":"https://api.github.com/users/tiguchi/gists{/gist_id}","starred_url":"https://api.github.com/users/tiguchi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiguchi/subscriptions","organizations_url":"https://api.github.com/users/tiguchi/orgs","repos_url":"https://api.github.com/users/tiguchi/repos","events_url":"https://api.github.com/users/tiguchi/events{/privacy}","received_events_url":"https://api.github.com/users/tiguchi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-05T16:03:07Z","updated_at":"2016-11-05T16:03:07Z","closed_at":null,"body":"## Problem\r\nOne of the ad server sources of uBlock Origin is the following URL:\r\nhttps://pgl.yoyo.org/adservers/serverlist.php\r\n\r\nThe host name pgl.yoyo.org resolves to the IP address 213.230.210.230, which in turn appears \r\nblacklisted by the Feodo tracker project over at abuse.ch as an **active trojan command and control server**: https://feodotracker.abuse.ch/host/213.230.210.230/\r\n\r\n## Background\r\nMy router has an \"intrusion prevention\" service that alerts me every time uBlock tries to download from that server.\r\n\r\nFirst of all I was thinking that may be a false positive since criminals have repackaged uBlock with malware in the past, and put it out in the wild. I assumed that a bad version of uBlock got some download servers blacklisted as well (as \"phone home\" servers).\r\n\r\nI sent an email to abuse.ch about my assumption that the blacklisting of that server may be a false positive.\r\nI got the following response from the head of abuse.ch, security researcher Roman Hüssy:\r\n\r\n> I've investigated your report and confirm that the said IP address is an\r\n> active Dridex botnet command&control server (C&C). This is *not* an FP.\r\n\r\nSo I guess that's bad news. That server should be considered as compromised. I don't think it's safe to download and use whatever data it returns."}}
{"actor":{"display_login":"tiguchi"}}