The logs at my domain philmfreax.com are showing multiple hits on the favicon from Turkey to a page that pretends to be ibiblio.org:
http://[redacted][.]oszar[.]com/
Digging further they seem to be asking for donations to UNC.
https://[redacted][.]oszar[.]com/
Seems suspicious to me…
[post edited to remove direct links to possible scam]