Monokai Slideshow manipulation - malware? SEO Spam infection Avast blocks!

polonus · 2015-08-31T09:35:05.000Z

:)See: https://urlquery.net/report.php?id=1441005093642
Fortinet flags as malware. 3 detect: https://www.virustotal.com/nl/url/7088b51da205c84e5c9dbcdef8ba928e1e43c8c9b841ae55481c8a7d5710f0d1/analysis/
Sucuri detects as SEO Spam: https://sitecheck.sucuri.net/results/roachbrown.binachron.com
Known Spam detected. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?sb

////////

.gjp2{position:absolute;clip:rect(408px,auto,auto,465px);} *Known javascript malware. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?g12 t='';}}x[l-a]=z;}document.write('<'+x[0]+' '+x[4]+'>.'+x[2]+'{'+x[1]+'}');}xViewState();

WordPress version outdated: Upgrade required.
Outdated WordPress Found: WordPress Under 4.2
WordPress Version
3.7.10
Version does not appear to be latest 4.3 - update now.
The following plugins were detected by reading the HTML source of the WordPress sites front page.

nextgen-gallery latest release (2.1.9)
http://www.nextgen-gallery.com

WordPress Theme
The theme has been found by examining the path /wp-content/themes/ theme name /

Roach Brown 1.1http://wordpress.org/

Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.

User ID 1 : oskar
User ID 2 : Nonesed?

polonus · 2015-08-31T09:50:58.000Z

Avast detects JS.HideLink.A there, we are being protected, folks,

polonus

polonus · 2015-08-31T10:28:00.000Z

More PHISHing going on from that IP: https://urlquery.net/report.php?id=1440359402168
→ https://www.threatcrowd.org/ip.php?ip=97.74.141.1
http://www.scumware.org/report/97.74.141.1
http://www.nictasoft.com/ace/ip-search/?ip=97.74.141.1 (flagged by Avast as JS.HideLink.A as well )

pol

Announcements