IP badness history: https://www.virustotal.com/nl/ip-address/111.221.41.13/information/
Avast detects HTML:Phishing-CQ [Trj] on IP, but not on this particular defaced website.
→ http://killmalware.com/citraferrite.com/# → https://www.virustotal.com/nl/url/95b853a8a84b1f0ec385a91220175d006bdb80deda501312453041a2d60cc3a0/analysis/1451565043/
Quttera has it: index.html
Severity: Malicious
Reason: Detected malicious PHP content
Details: Website Defaced
System Details:
Running on: nginx
Cached from: Backend Unable to properly scan your site.
Hacked site has shockwave malware: htxp://8pic.ir/images/pfdzd6qmzp17flfwb5gf.swf
polonus