Avast community forum
Home
Help
Search
Login
Register
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
Blacklisted site, likely compromised, but malware?
« previous
next »
Print
Pages: [
1
]
Go Down
Author
Topic: Blacklisted site, likely compromised, but malware? (Read 1637 times)
0 Members and 1 Guest are viewing this topic.
polonus
Avast Überevangelist
Probably Bot
Posts: 34065
malware fighter
Blacklisted site, likely compromised, but malware?
«
on:
May 01, 2014, 09:08:33 PM »
See:
http://app.webinspector.com/public/reports/show_website?site=http%3A%2F%2Fbiznes-design.ru
See:
http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fbiznes-design.ru%2F
alert on: Joomla Version 2.5.x for: htxp://biznes-design.ru//language/en-GB/en-GB.ini
Only blacklisted? ->
http://quttera.com/detailed_report/biznes-design.ru
Flagged twice:
https://www.virustotal.com/nl/url/d07d388eba43423e6418dbb98b7bab41d601659684e28eb47af76935fac06fa7/analysis/
Badness history on IP:
https://www.virustotal.com/nl/ip-address/176.57.209.69/information/
Not recently active as spammer:
http://www.stopforumspam.com/ipcheck/176.57.209.69
Further report:
https://isc.sans.edu/ipinfo.html?ip=176.57.209.69
Seems the malware for site has been closed:
http://support.clean-mx.de/clean-mx/viruses.php?ip=176.57.209.69&sort=id%20DESC
before that ->
http://support.clean-mx.de/clean-mx/view_virusescontent.php?url=http%3A%2F%2Fbiznes-design.ru%2F
Flagged as Threat IP - first seen 3 years ago, last seen 4 minutes ago as MODIFIED ITAR threat danger level 1, 17 minutes ago Russia, also threat danger level 1, and 2 hours ago as Eastern Europe, threat danger level 1.
Nothing here:
http://urlquery.net/report.php?id=1398970623556
Javascript check suspicious:
ase href="htxp://biznes-design.ru/" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta name="rights" content="ð¡ñ�ð¾ð»ð¿ð¾ð²ñ�ðºð¸ð¹ ð�ð½ñ�ð¾ð½" /> ...
External link check - web rep issue:
https://www.mywot.com/en/scorecard/html-email.ru?utm_source=addon&utm_content=rw-viewsc
pol
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.
Use NoScript, a limited user account and a virtual machine and be safe(r)!
jefferson sant
Starting Graphoman
Posts: 6669
volunteer
Re: Blacklisted site, likely compromised, but malware?
«
Reply #1 on:
May 02, 2014, 02:18:50 AM »
Detection was added
the iframes and malicious script
http://killmalware.com/biznes-design.ru/
http://zulu.zscaler.com/submission/show/e1b45280c900206666a6e673c65fd18e-1398989840
Logged
Print
Pages: [
1
]
Go Up
« previous
next »
Avast WEBforum
»
Other
»
Viruses and worms
(Moderators:
Maxx_original
,
misak
) »
Blacklisted site, likely compromised, but malware?