(IP Address: 172.67.73.233 on Port: 433) I forgot to delete the color my bad.
I got this same popup a few minutes later, as I was clicking off it, as I thought it was a duplicate popup that happened for whatever reason. I realized the first 3 digits of the IP Address in the 2nd Popup shared, were a little different then the ones on this one. (I think same port too, didn’t get a proper look as I clicked off it ofc.)
Here’s what I could already find via searching the IP on whois: Whois Lookup Captcha
I don’t even recognize going on the website, checked my browsing history too fyi, didn’t come up. Must’ve been a different link trying to secretly redirect me (or something, idk lol).
The website cubeupload is an image hosting site and i.cubeupload.com / u.cubeupload.com is the content servers. Years ago people were uploading malicious files:
If you try to go to either one directly, you get “HTTP ERROR 500”. I think if you have an account and log in, you should have no trouble accessing your uploaded images. They might not allow ‘hot linking’ any more or have security protocols to prevent malicious files.
Those popup’s images might be hosted there and the uploader might be using some scripts to fetch the images.
The site is a hosting site and like any other host, it gets a blacklisting when it is determined something malicious is coming from it. The domain itself might not be malicious to visit it, but if its customers are uploading malicious content, then it will remain black listed until they fix the issue and ask to be removed from the blacklist.
The question would be, is there still malicious content on that domain?
You never mentioned how you came across that site or why you are interested in it. Did you find a file or image that is hosted there? Was it a popup that has its images originating from it? Its hard to help when I don’t know all the information that cause the inquiry.
The domain was registered in 2006 using the registrar Domainbox (Mesh Digital Ltd), which is a sub division of Godaddy. On my initial visit, it looks abandoned to me and all images seem to be deleted. This is one of the pages that looks like it was a sample page on how to use it for embedding the images on a website: https://cubeupload.com/codes/774637
I came across the website via the popup that it has a trojan. Assuming i must have clicked on a link without realising that it was gonna take me there idk.
