The reason Zulu missed is likely because the content of the URL couldn’t be retrieved, hence HTTP Status Code: 500 Server Unavailable.
[...]Some people get the “domain suspended due to abuse” message while others get redirected to [link removed] and [link removed], which suggests that there is some server-side logic that filters traffic (probably by IP, Referrer , etc.)
As I reported to you pseudo random domains are now being blocked by the avast Network shield.
I am delighted avast has us all protected here.
Other users read here: http://forum.avast.com/index.php?topic=100691.0
Another one with a block of malcious obfuscated script: http://urlquery.net/report.php?id=83006 12 x IDS alert
Code there is heavily obfuscated JavaScript and is hosting a BlackHole Exploit Kit
The BlackHole Exploit Kit is serving the following exploits:
Java Rhino | Java OBE | PDF ALL | PDF LIBTIFF | HCP | FLASH
Sucuri finds it: http://sitecheck.sucuri.net/results/afisha76.ru/acinfo.html and detects MW:ANOMALY:SP7 malware
Thanks for keeping a finger onto the pulse of that VT detection for us.
Now you probably see how important it was when urlquery brought that Emerging Threats IDS in
and in a second instance snort IDS to their scanning engine.
It really detects a lot of anomalous patterns in webtraffic vital for early detection of these undetected sites and their malicious patterns.
Html and script analysis also will turn the light on the nature of these sites (Sucuri),
but I find a lot are still going under the normal av solution/anti-malware radar for too long,
