See Sucuri’s findings: avast detects as JS:HideLink-A [Trj]
ISSUE DETECTED DEFINITION INFECTED URL
SEO Spam MW:SPAM:SEO?g12 htxp://www.brugnetti.com/prodotti.htm
SEO Spam MW:SPAM:SEO?g12 htxp://www.brugnetti.com/prodotti/alexia.htm
SEO Spam MW:SPAM:SEO?g12 htxp://www.brugnetti.com/prodotti/delta.htm
SEO Spam MW:SPAM:SEO?g12 htxp://www.brugnetti.com/prodotti/takeaway.htm
SEO Spam MW:SPAM:SEO?g12 htxp://www.brugnetti.com/prodotti/compactde.htm
Known javascript malware. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?g12
t=‘’;}}x[l-a]=z;}document.write(‘<’+x[0]+’ ‘+x[4]+’>.‘+x[2]+’{‘+x[1]+’}</‘+x[0]+’>');}dnnViewState();
blacklisted domains by Quttera’s: wXw.autson.com
wXw.brugnetti.com
Web application version:
Joomla Version 1.5.18 - 1.5.26 for: htxp://www.brugnetti.com/media/system/js/caption.js
Joomla Version 1.5.18 to 1.5.26 for: htxp://www.brugnetti.com/language/en-GB/en-GB.ini
Joomla version outdated: Upgrade required.
Outdated Joomla Found: Joomla under 2.5.26 or 3.3.5
XSS vuln: Results from scanning URL: hxtp://www.brugnetti.com/cache/widgetkit/widgetkit-49b606cf.js
Number of sources found: 63
Number of sinks found: 28
DNS report: http://www.dnsinspect.com/brugnetti.com/1415295820
Security Header Check: Result Category Name Actual Value Our Recommendation
Missing Framing X-Frame-Options Use ‘sameorigin’ Details
Missing Transport Strict-Transport-Security Use ‘max-age=31536000; includeSubDomains’
Missing Content X-Content-Type-Options Use ‘nosniff’
Correct Content Content-Type text/html; charset=utf-8 Use ‘text/html;charset=utf-8’
Missing XSS X-XSS-Protection Use ‘1; mode=block’
Warning Cookies Set-Cookie e9be2e64351aab648c06…VvRhO96YoRg1; path=/ Add ‘secure; httponly;’
Warning Cookies Set-Cookie lang=deleted; expire…00:00:01 GMT; path=/ Add ‘secure; httponly;’
Warning Cookies Set-Cookie jfcookie=deleted; ex…00:00:01 GMT; path=/ Add ‘secure; httponly;’
Warning Cookies Set-Cookie jfcookie[lang]=delet…00:00:01 GMT; path=/ Add ‘secure; httponly;’
Warning Caching Cache-Control post-check=0, pre-check=0 Add ‘no-cache, no-store, must-revalidate’
Correct Caching Pragma no-cache Use ‘no-cache’
Correct Caching Expires Mon, 1 Jan 2001 00:00:00 GMT Use ‘-1’. Currently, expiration is current time minus -436988742 seconds.
Missing Access Control X-Permitted-Cross-Domain-Policies Use ‘master-only’
Missing Content Security Policy Content-Security-Policy Try Content-Security-Policy-Report-Only to start. Include default-src ‘self’, avoid ‘unsafe-inline’ and ‘unsafe-eval’
Warning Privacy P3P CP=“NOI ADM DEV PSAi…UR OTRo STP IND DEM” Remove obsolete header
There certainly should be some attention given to Server configurations and CMS update routines to make website more secure!.
IP badness: https://www.virustotal.com/nl/ip-address/208.113.168.184/information/
Re: http://sameid.net/ip/208.113.168.184/
Phishing on same IP: http://support.clean-mx.de/clean-mx/phishing.php?review=208.113.168.184&sort=id%20DESC
polonus