gle[.]net/analytics.php?version=1.0”.
The page loaded by this iframe looks empty, but if you check its source code you’ll see the CoinImp cryptominer.
Interesting, the last time we saw malware with unusual hostname notation (non-dotted decimal notation of IP address in that case), it was also related to fake Google Analytics and cryptominers.
Bad actors frequently use little-known features of programming languages and web protocols to obfuscate their code. It helps them temporarily stay below the radar of security tools that may not be prepared to properly process edge cases introduced by those features. Adding a period character at the end of domain names seems to be one of such tricks. While it may fool some tools in the short run, such tricks don’t usually remain effective for longer periods.
Do you believe that your website may have been infected with an unwanted cryptominer or other malicious content? We’ve put together a number of helpful guides to assist you with malware and blacklisting removal. If you need a hand cleaning malicious cryptominers or other malware from your site, we’re always happy to help.