Phishing site on same IP, site taken down?

[polonus]

See: http://rosarms.info/rgh.php
Same IP sire detected: https://www.virustotal.com/nl/url/75be81236551528de7cdf1ce43eda688f80215880e035c5a1a26e0aa97abf92e/analysis/
Undefined: http://urlquery.net/report.php?id=6418412 → 11004 [11004] Valid name, no data record (check DNS setup)
Seems down Unable to properly scan your site. Unable to connect.
IP scan → http://urlquery.net/report.php?id=6418294
Scan for: http://rosarms.info Different autonomous systems WARNING: Single point of failure +
Hostname: rosarms.info WARNING: Not all of your nameservers are in different subnets
IP address: 94.242.228.66 (redirects to abusehosting.net Date Created: Sun Aug 11 01:16:36 2013) → http://sameid.net/ip/94.242.228.66/
http://urlquery.net/report.php?id=6423966
System Details:
Running on: nginx/1.4.1

pol

[polonus]

Sure something going on here, see this report: http://www.solvedns.com/http://dimeracid.net/
see: http://www.solvedns.com/http://62.109.10.78
and for htxp://rosarms.info/rgh.php → http://www.solvedns.com/http://rosarms.info/rgh.php (where is the other MC record? - at least two are needed -
could be on another AS)
A baddie on that same IP: http://urlquery.net/report.php?id=8491
with 35 instances of this IDS alert: ET CURRENT_EVENTS HTTP Request to a *.tk domain - I get a poor web rep warning from WOT and a Bitdefender TrafficLight warning for malicious website. => https://www.virustotal.com/nl/url/8486e5948588dd44155837f42ad0bcc829a0bea0b1ab87bccd9b5acdeba30d9f/analysis/
detected here however: http://hosts-file.net/?s=allmobi.tk EMD Classification means High Risk Malware Site…

polonus