Hacked and defaced website on DROWn vulnerable nameserver!

Viruses and worms
1

See: http://killmalware.com/swanenburg.net/#
Nameserver expoloitable: http://killmalware.com/swanenburg.net/#
Reversed DNS shows

CHYBA

ERROR
Požadovaný dokument nebyl nalezen…
Requested document not found…
Pokud si myslíte, že by dokument měl existovat,
napište prosím správci těchto stránek.
If you are certain this document should exist,

please contact admin of these pages.

→ http://toolbar.netcraft.com/site_report?url=http://globenet.cz

There is something inherently wrong on those hosting server(s): https://asafaweb.com/Scan?Url=indigo.globenet.cz
This caused that server could be hacked (errors-Fail and hash Dos vulnerability)

They should mitigate issues on this Prague Windows Server!

polonus (volunteer website security analyst and website error-hunter)

2

Update
Element Reason
HTML JavaScript code JavaScript virus injection Reason: long string Code: #########################################\n Hacked by WholeOP Crew\n________________________________

Situation has not changed: Web Server Details
Scan for: -http://swanenburg.net
Hostname: swanenburg.net
IP address: 81.95.100.137

System Details:
Running on: Microsoft-IIS/8.5
Powered by: ASP.NET → https://asafaweb.com/Scan?Url=swanenburg.net One fail and two warnings.
Microsoft IIS httpd 8.5 risky method: TRACE
Nameserver is DROWn vulnerable: https://test.drownattack.com/?site=alfa.ns.active24.cz

See 34 entries on one and the same IP: https://www.threatminer.org/host.php?q=81.95.100.137
Related resource: https://www.virustotal.com/en/ip-address/81.95.100.137/information/

polonus (volunteer website security analyst and website error-hunter)