Innocent code or more?

Viruses and worms
1

See unknown html detected by VirusWatch here: Up(nil): unknown_html RIPE RU support at selectel dot ru 185.11.73.200 to 185.11.73.200 luckycode dot ru htxp://luckycode.ru/
Nothing here: http://sitecheck.sucuri.net/results/luckycode.ru/
Here: http://killmalware.com/luckycode.ru/
What is this? htxp://luckycode.ru/%d0%b4%d0%be%d1%80%d0%b0%d0%b1%d0%be%d1%82%d0%ba%d0%b0%d0%bf%d0%be%d0%bc%d0%be%d1%89%d1%8c/
link = href=“htxp://luckycode.ru/%d0%b4%d0%be%d1%80%d0%b0%d0%b1%d0%be%d1%82%d0%ba%d0%b0%d0%bf%d0%be%d0%bc%d0%be%d1%89%d1%8c/feed/”
Flagged by SOPHOS as malicious: but why? DNS Lookup for “xn-----7kcacdcygarocyrptlda6aci6b4c” failed. System.Net.Sockets.SocketException Host is unknown.
malware on IP: http://urlquery.net/report.php?id=1402034107584
Domain actually down?

pol

2

W32.HfsGFT.777b not detected by avast! reported to virus@avast.com
See: http://killmalware.com/hardwaremart.co.th/ganteng.htm (Hacked).
See: http://sitecheck.sucuri.net/results/hardwaremart.co.th/ganteng.htmISSUE DETECTED DEFINITION INFECTED URL
Defacement MW:DEFACED:01 htxp://hardwaremart.co.th/ganteng.htm ( View Payload )
Defacement MW:DEFACED:01 htxp://hardwaremart.co.th/404javascript.js ( View Payload )
Web site defaced. Details: http://sucuri.net/malware/entry/MW:DEFACED:01

Hacked by d3b~X Re: https://www.virustotal.com/nl/url/bc36f7cd7af7cbd9634ae09b8d5af19ca5b3580598c56ccc015fc54427fb44b3/analysis/1405789221/ and filescan (flagged thrice) https://www.virustotal.com/nl/file/71b9b409bd2e551ed32a9ebc8e29c849b7944566486ec2c520894808c2b4e832/analysis/1403677022/ Navigation suspicious: http://www.siteadvisor.com/sites/hardwaremart.co.th PHISHING and privacy related issues. 6 domains on IP: http://sameid.net/ip/27.254.59.43/ Consider: http://urlquery.net/report.php?id=1405789792850

polonus