Conflicting results in website scanning...

Viruses and worms
1

Given as clean here: http://urlquery.net/report.php?id=3456300
Infected in an earlier phase:
Given clean also here: http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fweb.7k7k.com
Again flagged here: http://www.avgthreatlabs.com/sitereports/domain/7k7k.com/domain-search-widget/www.avg.com.au as with HTML/Framer
Hacker Ninja finds:
Bing Test PASSED
AntiVirus Scan PASSED
Google bot Test PASSED
Scan for Hostile Strings **Risk Identified
Generic Web Bot test **Risk Identified
Google Malware List PASSED

polonus

2

See what was analyzed here: http://vurldissect.co.uk/default.asp?url=http%3A%2F%2Fweb.7k7k.com&btnvURL=Dissect&selUAStr=1&selServer=1&ref=&cbxSource=on&cbxBlacklist=on
where resolution failed: http://hosts-file.net/default.asp?s=http%3A%2F%2Fweb.7k7k.com
What is going on from that IP: http://support.clean-mx.de/clean-mx/viruses.php?ip=113.107.236.12&sort=id%20DESC
Sure there is PHISHING going on there…
Malware from that domain: http://62.67.194.183/clean-mx/viruses.php?domain=7k7k.com&sort=email%20asc
Also distributing Address Toolbar junkware…

polonus

3

Another scan with conflicting results: http://urlquery.net/report.php?id=3471306
and
http://quttera.com/detailed_report/zalil.ru
and
http://sitecheck.sucuri.net/results/zalil.ru/34590512/78674e2c.51d0c810/deadzone.exe (only blacklisted)

polonus

4

Another pair of conflicting scans:
Just an IDS alert here: http://urlquery.net/report.php?id=3483032 & http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fholdenimports.com%2F
blacklisted here: http://scanurl.net/?u=http%3A%2F%2Fholdenimports.com%2F&uesb=Check+This+URL#results
Just one detection here: https://www.virustotal.com/nl/url/641f631c85c37be486c0c10b0ce1b8b72cbf71f17e14db4bbc6eb9b2df6c2d94/analysis/
No doubts about scan results here: http://zulu.zscaler.com/submission/show/39695da666ba5cabc1ced6a2f458a0ec-1372797947
versus given clean here: http://www.quttera.com/#online url malware scanner
Site is on PHISHWatch: http://support.clean-mx.de/clean-mx/phishing.php?id=3418520

polonus

5

Another one given clean by AVG Threat Labs, blacklisted by Google Safebrowsing.
http://zulu.zscaler.com/submission/show/e51e98cbac688e833c4abebecaf2d528-1372854013
Detected by urlquery: http://urlquery.net/report.php?id=3501735
Hacker ninja gives: Scan for Hostile Strings **Risk Identified & Generic Web Bot test **Risk Identified
This site is not safe. Please view details below.Decryptor Injection (GJS185C)
Phishing (CAT021)
Resdirecting to a PseudoRandom domain name: http://pastebin.com/k3k7ibvJ
For malware, see: http://sitecheck.sucuri.net/results/icrahaber.com
known javascript malware: http://labs.sucuri.net/db/malware/malware-entry-mwjsanon7

polonus