Author Topic: Malware on parked site or parked site because of malware? (Read 1108 times)

polonus · « **on:** October 07, 2015, 01:23:50 AM »

See: https://urlquery.net/report.php?id=1444171833243 two alerts.
Here it seems active and registered: http://whois.domaintools.com/tlybqh.com
Given as newly registered site: http://toolbar.netcraft.com/site_report?url=http://tlybqh.com

https://www.virustotal.com/nl/url/eda5f7d97837496496cf39e2e46e41e669c30d05deb6bffa37cb5284da17f314/analysis/1444171980/
Quttera has nothing on it: http://quttera.com/detailed_report/tlybqh.com
Sucuri: Unable to properly scan your site. Unable to connect. received data for me:

Quote

Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1

Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Tue, 06 Oct 2015 22:56:02 GMT
Content-Length: 295
Age: 7

<!DOCTYPE html><body style="padding:0; margin:0;"><html><body><iframe src="htxp://mcc.godaddy.com/park/ZGt0YwR2BP4kZwxhZl4=" style="visibility: visible;height: 100%; position:absolute" allowtransparency="true" marginheight="0" marginwidth="0" frameborder="0" width="100%"></iframe></body></html>

Runtime error and website not available see Custom errors:Fail and two warnings: https://asafaweb.com/Scan?Url=tlybqh.com

Suspicious on iFrame check:
Suspicious

-http://mcc.godaddy.com/park/m3yfo2e1yaovrt==/fe/nzcdyaevlae5pv5jlab='

Suspicious on Javascript Check:
Suspicious

in:0;"><html><body><iframe src="-http://mcc.godaddy.com/park/m3yfo2e1yaovrt==/fe/nzcdyaevlae5pv5jlab=" style="visibility: visible;height: 100

This was blocked by uMatrix: hxtp://mcc.godaddy.com//v1/js/Login.min.js?v= adware...

polonus