Author Topic: What is out here? Why site is flagged? Abuse-Network-Nightmare?  (Read 1077 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34067
  • malware fighter
What is out here? Why site is flagged? Abuse-Network-Nightmare?
« on: November 29, 2014, 02:42:00 PM »
See: https://www.virustotal.com/en/url/3cae739b88ff16e723ac471f938b1cdaf8634bb0a77b160af4bde21f2882c842/analysis/1417266919/
Outdated server software: http://sitecheck.sucuri.net/results/zhongren-r.cn#sitecheck-details
IP abuse reported here: https://www.firyx.com/whois?ip=63.141.229.20
Listed as suspicious by Google Safe-browsing:
Server/redirect status 503
Google Browser Difference: Not identical

Google: 257 bytes       Firefox: 21014 bytes
Diff:         20757 bytes

First difference:
</html> ...
Listed here: http://networknightmare.net/DDoS/Scripts/iptables.limit.ddos.txt
| http-robots.txt: 2 disallowed entries IP PTR:   Resolution failed
|_/play-* /money/*
|_http-title:  \xE5\x8F\x8B\xE6\x83\x85\xE6\x8F\x90\xE9\x86\x92 UTF-8

Name servers did not respond: http://www.dnsinspect.com/zhongren-r.cn/1417267941
warning: Name servers software versions are exposed.

MyWOT negative: https://www.robtex.com/en/advisory/ip/63/141/229/20/

Remarks: dynamically-assigned reverse DNS entries; Hosts found sending virus mails ; Hosts found sending phishing mails ;
Hosts found sending mail contaning spam images; Hosts are added by our bots as users connect with hacked boxes and open proxies;
Lists 's that sent more than 2 virus in the last 24 hours; Direct UBE sources, verified spam services and ROKSO spammers;
llegal 3rd party exploits, including proxies, worms and trojan exploits.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!