Defaced - GoDaddy Singapore abuse....

Viruses and worms
1

See: http://killmalware.com/oxp.in/#
Issues: http://www.dnsinspect.com/oxp.in/1453928091
WARNING: Name servers software versions are exposed.
WARNING: MX records duplicates (same IP address):
2404:6800:4003:c02::1b: [alt2.aspmx.l.google.com. aspmx3.googlemail.com.]
64.233.165.26: [alt1.aspmx.l.google.com. aspmx2.googlemail.com.]
74.125.68.26: [alt2.aspmx.l.google.com. aspmx3.googlemail.com.]
Although technically valid, duplicate MX records have no benefits and can cause confusion.
See: http://toolbar.netcraft.com/site_report?url=http://oxp.in
Excessive server header info proliferation: Apache/1.3.37 Unix mod_throttle/3.1.2 DAV/1.0.3 mod_fastcgi/2.4.2 mod_gzip/1.3.26.1a PHP/4.4.4 mod_ssl/2.8.22 OpenSSL/0.9.7e
For IP: http://toolbar.netcraft.com/site_report?url=http://203.124.118.1
and http://toolbar.netcraft.com/site_report?url=http://sg2nlhg610c1610.shr.prod.sin2.secureserver.net
Not malicious per se: http://www.isithacked.com/check/http%3A%2F%2Fsg2nlhg610c1610.shr.prod.sin2.secureserver.net%2F

polonus

2

Avast has nothing to say on this site…

3

Defaced does not always mean malicious, in most cases i see it is not
https://www.virustotal.com/en/file/ee15143aab9682483e5a2140313db440dea15630fb63e23305242416c482bdd9/analysis/1453929912/

Just a changed (defaced) website, click picture http://urlquery.net/report.php?id=1453930001881

4

Avast still blocks some defaced sites :slight_smile:

5

Hi Steven Winderlich,

Avast should alert defaced websites, also the non-malicious variants, as such websites may come with abhorrent content that may be severely upsetting to those that may click on a link to such a page.
As until now Avast only flags such sites when active malware like javascript or other malware is running on a defaced website site and it may be virulent for computers.
DrWeb alerted pages that had no specific malware “an sich” but could be bad for those on the Interwebs with weak nerves.

polonus