Author Topic: Possible FP site  (Read 1270 times)

0 Members and 2 Guests are viewing this topic.

Wyphy

  • Guest
Possible FP site
« on: February 28, 2012, 05:11:54 PM »
Code: [Select]
http://forums.hrdsoftwarellc.com/
Just started triggering a couple of days ago and not sure why.
Tried two sites that were referenced last time I reported a possible FP site and they both show clean:
http://sitecheck.sucuri.net/results/http://forums.hrdsoftwarellc.com/
http://wepawet.iseclab.org/view.php?hash=38702db95469962d17afc2ea74ccd902&t=1330445134&type=js

Thoughts?
Cheers.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34065
  • malware fighter
Re: Possible FP site
« Reply #1 on: February 28, 2012, 06:50:49 PM »
Suspicious code here: forums.hrdsoftwarellc dot com/clientscript/vbulletin-core.js?v=418 suspicious
[suspicious:2] (ipaddr:206.188.204.96) (script) forums.hrdsoftwarellc dot com/clientscript/vbulletin-core.js?v=418
     status: (referer=forums.hrdsoftwarellc dot com/)saved 51202 bytes f1094482f8f64219e8531d20d8ccd82166f84bc5
     info: [decodingLevel=0] found JavaScript
     suspicious:  also see: htxp://urlquery.net/report.php?id=26215
But I get no avast alerts, see: htxps://www.virustotal.com/url/47c69ea9a1f18719c7a2d718563acf4c07b4bec3acdfd0132101b951e2a00529/analysis/

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!