The logs at my domain philmfreax.com are showing multiple hits on the favicon from Turkey to a page that pretends to be ibiblio.org:
http://i777777o696269626c696fo6f7267z.oszar.com/
Digging further they seem to be asking for donations to UNC.
https://i67697665o756e63o656475z.oszar.com/
Seems suspicious to me…