ASP.NET remote only defacement on website...

Viruses and worms
1

See: http://killmalware.com/imperigroup.com/#
Fail and 3 warnings: https://asafaweb.com/Scan?Url=imperigroup.com
Microsoft IIS7 httpd 7.5
| http-methods: Potentially risky methods: TRACE
reversed: http://toolbar.netcraft.com/site_report?url=http://ho01-is-s410.active24.com
https://oscarotero.com/embed/demo/index.php?url=http%3A%2F%2Fho01-is-s410.active24.com%2F&options[minImageWidth]=0&options[minImageHeight]=0&options[facebookAccessToken]=&options[embedlyKey]=&options[soundcloudClientId]=YOUR_CLIENT_ID&options[oembedParameters]=

polonus

2

Similar hack on ASP.NET website: http://killmalware.com/recuperation-et-transfert.com/
but also Google Safebrowse alerted!
See: http://urlquery.net/report.php?id=1451732931706
Fail and three warnings: https://asafaweb.com/Scan?Url=imperigroup.com
Defacer’s site: http://toolbar.netcraft.com/site_report?url=http://bydevil.com
From: ec2-54-201-82-69.us-west-2.compute.amazonaws.com - 54.201.82.69
→ OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0) - http-server-header: nginx/1.4.6 (Ubuntu)
This is a badware link: uBlock₀ has prevented the following page from loading:
-http://i.com.com/
Because of the following filter
||com.com^$document
Found in: uBlock filters – Badware risks

Here we have: http://whois.domaintools.com/bydevil.com as 141.8.226.19
prevented from loading by script blocker was: -http://fwdservice.com/ http://168.144.144.106/ (not available)
host appears down! → http://research.domaintools.com/research/screenshot-history/bydevil.com/#

And again another website as such detected here: http://www.zone-h.org/mirror/id/22314681?zh=1

on hoster bydevil.com it resolves as: http://toolbar.netcraft.com/site_report?url=http://85.95.226.7
Re: https://oscarotero.com/embed/demo/index.php?url=http%3A%2F%2F85.95.226.7%2F&options[minImageWidth]=0&options[minImageHeight]=0&options[facebookAccessToken]=&options[embedlyKey]=&options[soundcloudClientId]=YOUR_CLIENT_ID&options[oembedParameters]= Website risk status 10 red out of 10: http://toolbar.netcraft.com/site_report?url=http://85.95.226.7

polonus