Need Someone to Test This Site Sandboxed.

[Jack 1000]

Dear Avast,

Please sandbox and test ghostvillage.com.  About two years ago, Avast warned of a virus there, and a few weeks ago, I got a report from an Avast user who said that he/she went to the site and got a virus warning.  However, checks with Virus Total, URLVoid, and Brightcloud show a clean site.  Is this a FP that was not cleared?

Jack

[DavidR]

Two years and a few weeks ago are ancient history in terms of infected sites as the avast web shield is doing a live scan. So you can't chase possible FPs on old results.

No alert by avast on the site when I just visited it using firefox 12.0.

[Pondus]

Zulu report  risky IP address by one or more sources
http://zulu.zscaler.com/submission/show/c85aeaac955724eadd0969abf582758c-1336846467

[!Donovan]

http://urlvoid.com/scan/ghostvillage.com/


No other site with the IP of 67.227.172.79.

[polonus]

Hi !Donovan & Jack 1000,

I see a misused or defaced server history for that IP range. So there must be server issues for domains on that range have been defaced.
 Let us see; server gives away to the world and hackers all of the version and also via the system info under certain circumstances
see: htxp://sitecheck.sucuri.net/results/ghostvillage.com/  under system details -  safersite.de does not give this for the scan...
(this could be easily remedied: http://nixcraft.com/getting-started-tutorials/746-apache-php-web-server-security-hiding-version-information.html  (link author = Nixcraft)). OK here: htxp://urlquery.net/report.php?id=54520
One code hick-up flagged: pagead2.googlesyndication dot com/pagead/ads.js benign
[nothing detected] (script) pagead2.googlesyndication dot com/pagead/ads.js
     status: (referer=wXw.ghostvillage.com/)saved 10516 bytes ce5e416db4e9b7dbd24e979fefe8d7e9bea43dc3
     info: [decodingLevel=0] found JavaScript
     suspicious,

polonus

[Jack 1000]

Hi !Donovan & Jack 1000,

I see a misused or defaced server history for that IP range. So there must be server issues for domains on that range have been defaced.
 Let us see; server gives away to the world and hackers all of the version and also via the system info under certain circumstances
see: htxp://sitecheck.sucuri.net/results/ghostvillage.com/  under system details -  safersite.de does not give this for the scan...
(this could be easily remedied: http://nixcraft.com/getting-started-tutorials/746-apache-php-web-server-security-hiding-version-information.html  (link author = Nixcraft)). OK here: htxp://urlquery.net/report.php?id=54520
One code hick-up flagged: pagead2.googlesyndication dot com/pagead/ads.js benign
[nothing detected] (script) pagead2.googlesyndication dot com/pagead/ads.js
     status: (referer=wXw.ghostvillage.com/)saved 10516 bytes ce5e416db4e9b7dbd24e979fefe8d7e9bea43dc3
     info: [decodingLevel=0] found JavaScript
     suspicious,

polonus

Thanks much Polonus!

This site should be watched IMO based on this new information.

Jack