Address unreachable

Viruses and worms
1

See Quttera’s: Scanning URL: htxp://zvukoff.ru N.B. avast! shields does not block main site!
Normalized URL:

htxp://zvukoff.ru
Last scan date:

1-8-2014 17:04:20
Current status:
Address is unreachable

Suspicious 59/100 here: http://zulu.zscaler.com/submission/show/346276a7bb13f7ceb10dfb1be00fbde5-1406912783

Sucuri detects: Site Potentially Harmful
Missed here: http://killmalware.com/zvukoff.ru/song/9164
See: http://fetch.scritch.org/%2Bfetch/?url=http%3A%2F%2Fzvukoff.ru%2Fsong%2F9164&useragent=Fetch+useragent&accept_encoding=

Javascript check: Suspicious

image’ content=‘htxp://zvukoff.ru/themes/classic/assets/images/logo_op.png’ /><meta name="…

Google browser Diff.: Not identical

Google: 95515 bytes Firefox: 96046 bytes
Diff: 531 bytes

First difference:
ner adb">

<iframe frameborder=“0” scrolling=“no” allowtransparency=“true” class=“bannersiframe” src=“/b/get/cbn4” style="height:180…

IP Badness history: https://www.virustotal.com/nl/ip-address/188.127.255.99/information/
flagged twice here: http://www.urlvoid.com/scan/zvukoff.ru/

IDS alert here: http://urlquery.net/report.php?id=1404221629882 for ET SHELLCODE Common 0a0a0a0a Heap Spray String
Background info on this threat: http://www.thegreycorner.com/2010/01/heap-spray-exploit-tutorial-internet.html
link article author = STEPHEN BRADSHAW Security Intelligence and Incident Response- Info for Educational Purposes Only.

polonus

2

Unreachable because of Google Safebrowsing block, clean site - only blacklisted?
Detected as such: http://quttera.com/detailed_report/spires-and-spans.com
Like here: http://urlquery.net/report.php?id=1406915611383
Found to be 84/100 malicious: http://zulu.zscaler.com/submission/show/4927e1270321c15053f0ba5ffdb12037-1406914823
Three flag here: https://www.virustotal.com/nl/url/e41b575c35cc61dcb8f0117472b8b98648fe1a9ad925ce47bd329b761ba6ffcc/analysis/1406914780/

js/tools.js found to be vulnerable? (Note by me - polonus) → http://fetch.scritch.org/%2Bfetch/?url=http%3A%2F%2Fspires-and-spans.com%2F&useragent=Fetch+useragent&accept_encoding= → http://linkeddata.informatik.hu-berlin.de/uridbg/index.php?url=http%3A%2F%2Fspires-and-spans.com%2Fjs%2Ftools.js&useragentheader=&acceptheader=

Blacklisted here: http://www.google.com/safebrowsing/diagnostic?site=spires-and-spans.com

IP badness history: https://www.virustotal.com/nl/ip-address/66.96.131.146/information/
AS info: http://sitevet.com/db/asn/AS29873

pol