Infected with malware - SE redirects, now cleansing!

Viruses and worms
1

Re: http://killmalware.com/leatrading.com/#
Not detected at VT.
Sucuri has it: https://sitecheck.sucuri.net/results/leatrading.comuspicious conditional redirect. Details: http://sucuri.net/malware/entry/MW:HTA:7
Redirects users to:http://89.248.172.68/hitin.php?land=20&affid=20110
redirect now not landing?

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html> <head> <title>Index of /</title> </head> <body> <h1>Index of /</h1> <ul></ul> </body></html>

→ http://toolbar.netcraft.com/site_report?url=http://leatrading.com

polonus

2

Update. Campaign seems ongoing with the same redirect IP address involved: http://killmalware.com/ayargroup.com/
See: https://www.virustotal.com/en-gb/ip-address/89.248.172.68/information/
Malicious activities reported: https://cymon.io/89.248.172.68
Website malware: Index page missing. Directory and file listing permitted.

Index of /


See: http://toolbar.netcraft.com/site_report?url=no-reverse-dns-configured.com
80/tcp open http Apache httpd 2.2.15
|_http-server-header: Apache/2.2.15 Webserver
|_http-title: Index of /
Website redirected: https://whois.domaintools.com/ayargroup.com
8 issues: https://mxtoolbox.com/domain/ayargroup.com/
Nameserver on ns1.parkingcrew.net → https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp
Nameserver organization has a very, very low web rep: https://www.mywot.com/en/scorecard
Big time spammer and scammer!

parkingcrew.net …something PHISHy out there?
You have 1 error
Wrong certificate installed.
The domain name does not match the certificate common name or SAN.
Warnings
SSLv3
This server uses the SSLv3 protocol which is not secure. Disable the SSLv3 protocol and enable a higher protocol version. Contact your web server vendor for assistance.
RSA remove cross certificates
The certificate chain contains a cross root (primary intermediate) certificate that should be removed. Use Symantec CryptoReport to remove cross root certificates.
This server is vulnerable to:
Poodle (SSLv3)
This server is vulnerable to a Poodle (SSLv3) attack. If you have not disabled SSLv3 fallback support, disable it now and use TLS 1.2 or higher.
Info
BEAST
The BEAST attack is not mitigated on this server.
Certificate information
This server uses a Domain Validated (DV) certificate. No information about the site owner has been validated. Data is protected, but exchanging personal or financial information is not recommended.
Common name:
-www.parkingcrew.com
SAN:
-www.parkingcrew.com
Valid from:
2014-Nov-24 00:00:00 GMT
Valid to:
2017-Jul-01 23:59:59 GMT
Certificate status:
Valid
Revocation check method:
OCSP
Organization:

Organizational unit:

City/locality:

State/province:

Country:

Certificate Transparency:
Not embedded in certificate
Serial number:
55f2ebb7f44e0b5ac0125a5d14e72035
Algorithm type:
SHA256withRSA
Key size:
2048
Certificate chainShow details
thawte Primary Root CAIntermediate certificate
thawte DV SSL CA - G2Intermediate certificate
-www.parkingcrew.comTested certificate
Server configuration

polonus