« previous next »
Pages: [1]   Go Down

Author Topic: Blocked by Avast .......site down?  (Read 2299 times)

0 Members and 2 Guests are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34051
  • malware fighter
Blocked by Avast .......site down?
« on: August 20, 2015, 12:01:18 PM »
See: https://www.virustotal.com/nl/url/f7ae080ea411af6a705560ec165e3de3c6304c3bbe1e1390dbab9ffb99fb7786/analysis/1440064057/
and not yet found in Quttera's database: URL -8hxig.7krtssmjdgww.com has not been found in database.
Annoyance: SWBPL Threats found: 1 
Netcraft Risk Status 2 red: http://toolbar.netcraft.com/site_report?url=8hxig.7krtssmjdgww.com
Canonical   -http://8hxig.7krtssmjdgww.com/mail/view;jsessionid=D80563D6302DE12A6C203C1BAB85068E?id=18846&mailid=m490069066&loginkey=982b7833d7848601796c26c5ea822df1dbcccc12791cd6a48d331bd8b52e43de

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34051
  • malware fighter
Re: Blocked by Avast .......site down?
« Reply #1 on: August 20, 2015, 07:23:49 PM »
Zulu Zscaler comes up with a 100/100% malicious: http://zulu.zscaler.com/submission/show/8d48c0f2f791a23bdbd5c166f3cc7a2a-1440091279

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: Blocked by Avast .......site down?
« Reply #2 on: August 20, 2015, 07:30:04 PM »
Because it is blacklisted here  SURBL  http://www.surbl.org    so, seems to be spam related

« Last Edit: August 20, 2015, 07:56:19 PM by Pondus »
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34051
  • malware fighter
Re: Blocked by Avast .......site down?
« Reply #3 on: August 20, 2015, 09:08:19 PM »
Hi Pondus,

IP related malware: http://urlquery.net/report.php?id=1439777608726
I see an alert for so-called Jump Code: http://www.jumpcode.com/jump-code-help.html

In the original scanned website I also found this via the Netcraft Tool scan: -spf-ntr.burn-oxygen.com
Re: http://threatcenter.crdf.fr/?MoreDomains&ID=13532232

See: http://isithacked.com/check/http%3A%2F%2F8hxig.7krtssmjdgww.com%2F

Checking for cloaking
There is a difference of 193 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that's trying to hide from browsers but make Google think there's something else on the page. show.

Status codes
These should normally all be the same.

Google Chrome returned code 200
GoogleBot returned code 403

On AS 14 Blacklisted URLs: http://sitevet.com/db/asn/AS9919

pol
« Last Edit: August 20, 2015, 09:31:36 PM by polonus »
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »