Is this site being flagged as potentially suspicious?

Viruses and worms
1

Sucuri finds nothing: http://sitecheck.sucuri.net/results/www.norman-rp.pl/
Urlquery results: http://urlquery.net/queued.php?id=4197039
Zulu Zscaler detects as with malware: http://zulu.zscaler.com/submission/show/aa5f03c17775ca564e17394960c76e59-1354546063 [93/100 malicious]
Google Safebrowsing flags: http://www.google.com/safebrowsing/diagnostic?site=http://www.norman-rp.pl
Quttera flags this file there: Potentially Suspicious files: 1
File size[byte]:
59
Threat type:
Potentially Suspicious
Details:
Detected unconditional redirection to external web resource.
Reason:

MD5:
B3F39106230AA49CE4B2A619811CEC09
Scan duration[sec]:
0.085000 [info Quttera scan data] content returned by request for ;url=htxp://wcrp.pl/">

polonus

2

Hi Polonus,

Seems nothing more than a direct redirect, but there could be a way of checking the referring URL to return a different output for the user; unless Google is reporting an issue that has been cleaned up already…

~!Donovan

3

Hi !Donovan,

Thanks for checking on this one.
Last time Google Safe Browsing found this site malicious was on 30-11-2012.
And you are right, because the malware survived just 3.4 hrs before being closed. That was from 2012-12-02 23:01:04 to 2012-12-03 02:25:22 to be precise, that totalled up to 3.4 hrs. The payload in the attack was logged as being `/tmp/BARTChw5e’, alas this is history now. BARTChw apparently as origin of this attack…
So we can establish here the ever changing, sometimes short lived nature, presence of malcode on websites.
Logging attack codes like sites like on bizimbal dot com and IDS alerts like those on urlquery dot net could be analyzed for dominating malware attack patterns to be recognized…

polonus