Blacklisted SEO Spam website flagged?

Viruses and worms
1

This OK: https://shaaaaaaaaaaaaa.com/check/4cheo.org
68 malicious files: http://quttera.com/detailed_report/4cheo.org
Detected encoded JavaScript code commonly used to hide malicious behaviour.

 [[fun//ction dnn//view//State]

See: Trojans detected:
Object: -http://4cheo.org/index.php?catid=128&itemid=172&option=com_sobi2&sobi2id=1344&sobi2task=sobi2details
SHA1: 11a5472a0b3e96bf0ab7474991c89d20de63a71d
Name: TrojWare.JS.Agent.caa
Re: https://www.virustotal.com/nl/url/014f110e473e434ffcc2b24f5d9f96f50c7e219837dcc7b0e5daab98ad09e4a6/analysis/1457433684/
Sucuri gives known javascript malware. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?g12
Joomla version outdated: Upgrade required.
Outdated Joomla Found: Joomla under 3.4.5
Consider: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fwww.insead.dk
WordPress issues on that link: WordPress Plugins
The following plugins were detected by reading the HTML source of the WordPress sites front page.

google-captcha 1.21 latest release (1.22) Update required
http://bestwebsoft.com/products/
Plugins are a source of many security vulnerabilities within WordPress installations, always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes.

Issues there: -http://www.insead.dk
Detected libraries:
jquery - 1.4.2 : -http://www.insead.dk/wp-content/themes/boldy/js/jquery-1.4.2.min.js
Info: Severity: medium
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4969
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
jquery.prettyPhoto - 2.5.6 : -http://www.insead.dk/wp-content/themes/boldy/js/jquery.prettyPhoto.js
Info: Severity: high
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6837&cid=3
Info: Severity: high
https://github.com/scaron/prettyphoto/issues/149
https://blog.anantshri.info/forgotten_disclosure_dom_xss_prettyphoto
jquery-migrate - 1.2.1 : -http://www.insead.dk/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
jquery - 1.11.3 : (active1) -http://www.insead.dk/wp-includes/js/jquery/jquery.js?ver=1.11.3
(active) - the library was also found to be active by running code
3 vulnerable libraries detected

polonus (volunteer website security analyst and website error-hunter)

2

For the IP of that website: 69.16.242.108
http://toolbar.netcraft.com/site_report?url=http://69.16.242.108
http://toolbar.netcraft.com/site_report?url=http://www.hartmanprofile.com log/in for website at liquid web
http://toolbar.netcraft.com/site_report?url=http://garfield.fatcatservers.com ?
Re: http://viewdns.info/dnsreport/?domain=4cheo.org
:o Nameserver supports SSLv2 export ciphers and is DROWn vulnerable: https://test.drownattack.com/?site=ns3.fatcatservers.com
Some admins in Chattanooga and Lansing Michigan have some threat to be mitigated :-[
? https://test.drownattack.com/?site=garfield.fatcatservers.com (vuln.).

polonus

3

DROWN lets an attacker perform MITM attacks on TLS connections in under 1 minute by sending probes to servers that support SSLv2. The vulnerability impacts roughly 33% of webservers worldwide. It also affects other services that allow SSLv2, including, email servers, embedded system, web applications, and software supporting SSL/TLS. Threat should be remediated asap!

polonus