Author Topic: Blacklisted site being blocked?  (Read 1250 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33903
  • malware fighter
Blacklisted site being blocked?
« on: May 14, 2018, 04:08:04 PM »
Domain blacklisted by Google Safe Browsing
Domain blacklisted by SiteAdvisor (McAfee)
Domain blacklisted By Yandex (via Sophos) -> https://sitecheck.sucuri.net/results/www.bjxncb.com#
Flagged https://www.virustotal.com/nl/url/b291f5ccdbd7c85e4ecf9d889cc51f1dce63f8ce85b7c2d127ca486585313436/analysis/1526306355/
Various threats & trojans flagged: https://urlquery.net/report/10456fb0-da4d-4c1a-901c-8fcf1229d940
Malicious site blacklisted: https://quttera.com/detailed_report/www.bjxncb.com
Malicious file reported:
Quote
Severity:   Malicious
Reason:   Detected reference to blacklisted domain
Details:   Detected reference to malicious blacklisted domain -gaiaphoto.cn
File size[byte]:   157226
File type:   HTML
Page/File MD5:   4F279119B20AA25DFEF75E76ADE97EF5
Scan duration[sec]:   2.008
Potential problems and suspicious url's found on: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=gaiaphoto.cn&ref_sel=GSP2&ua_sel=ff&fs=1
Suspicious URLs found in: htxp://gaiaphoto.cn

1: hxxp://js·users·51·la/19303716·js
2: hxxp://js·users·51·la/19155126·js

Script redirected in this line seems a bit suspicious:
Quote
   
////////< sc​ript type="text/javasc​ript"> if(window.location.toString().indexOf('pref=padindex') != -1){}else{i​///////f(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alca​////////tel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.user​Agent)))////////////{if(window.location.href.indexOf("?mobile")< 0){try{if(/Android|Windows Phone|webOS|iPhone|iP​od///////|BlackBerry/i.test(navigator.userAgent))/////{window.location.href="hxxp://gaiaphoto.cn/m/index.php";}e​lse if(/iPad/i.test(navigator.userAgent))///////{}else{}}////////////catch(e){}}}}< /sc​ript>
 
//// blocks and address broken by me, pol


polonus
« Last Edit: May 14, 2018, 04:22:11 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!