Fake Website

Viruses and worms
1

Dear Avast Team,

Please update your database to protecting user from fake website such as:
http://www.garuda-indonesia.com-newvoucher.com/

Virustotal result: https://www.virustotal.com/#/url/1e60930ce62282a17fecc980cbab5091a2fa8276dc659d44d2b602d04eef0400/detection

Official announcement from airflight: https://www.garuda-indonesia.com/id/id/news-and-events/penjelasan-garuda-indonesia-terkait-voucher-potongan-harga-tiket.page

Thanks.

2

Your virustotal scan result is 1 year old Last analysis 2017-05-16 16:38:09 UTC

always rescan for a fresh result … have done it for you

Rescan is found behind the blue button at top right :wink:

3

Hi Pondus,

Thanks for your response.

Anyway, the website which I have shared was confirmed fake and you may check official announcement from Garuda Indonesia and at same time ISP blocking the website as well.

Thanks.

4

You can report a suspicious/malicious sample (File/Website) here: https://www.avast.com/report-malicious-file.php

5

Hi Yanto.Chang,

Here we see that sedo-parked site still kicking up malcode:

https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=www.garuda-indonesia.com-newvoucher.com%2F&ref_sel=GSP2&ua_sel=ff&fs=1

Given 8 out of 10 benign here: https://zulu.zscaler.com/submission/a9cb7b0b-8ff4-4ea2-b13f-cec4fa0796d9

But that IP it is on, is certainly suspicious if not malicious: https://www.scumware.org/report/91.195.240.46.html
We have a launching site for HTLM/Refresh.BCtrojan

polonus (volunteer website security analyst and website error-hunter)

6

Hi,
the domain was added to our blacklist. Thank You for pointing out.
Jirka