Malicious ba.js flagged for this website? 

polonus · 2015-08-23T16:44:20.000Z

See: -http://urlquery.net/report.php?id=1440346619038
Flagged: 2015-08-23 2 -bitrix.info/ba.js Malware

Index
Severity: Suspicious
Reason: Detected suspicious redirection to external web resources at HTTP level. [What’s this?]
Details: Detected HTTP redirection to -http://patria.timeweb.ru/error_domain.htm.
→ -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fpatria.timeweb.ru%2Ferror_domain.htm
→ -http://1col.ru/www.patria.timeweb.ru code line 202
-redirect.php?url=https://qiwi.ru/replenish/terminals.action" tracker code.
iFrame:

 <iframe frameborder="0" width="0" height="0" name="downloader" sandbox="allow-same-origin"></iframe>

bitrix.ba.js is counter code, read: -http://dev.1c-bitrix.ru/community/webdev/user/121056/blog/11414/?commentId=59297

polonus

polonus · 2015-08-23T16:55:12.000Z

What to think of this scan? → -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fbitrix.info%2Fba.js *
See: -http://1col.ru/www.bitrix.info and you’ll see:

Welcome to nginx!
If you see this page, the nginx web server is successfully installed and working. Further configuration is required.

For online documentation and support please refer to -nginx.org.
Commercial support is available at- nginx.com.

Thank you for using nginx.

uMatrix has prevented the following page from loading:
-http://stats.wp.com/e-201534.js
pol

polonus · 2015-08-23T20:37:27.000Z

Also alerted via Fortinet’s here: -http://urlquery.net/report.php?id=1440360794299
See: https://www.virustotal.com/nl/ip-address/46.137.116.191/information/
8 red out of 10 for website risk status: http://toolbar.netcraft.com/site_report?url=http://46.137.116.191
ssl-cert: Subject: commonName=bitrix.info
This looks OK-> -http://isithacked.com/check/bitrix.info
Read: -https://dev.1c-bitrix.ru/api_help/main/functions/other/check_bitrix_sessid().php

polonus

Announcements