-http://arabobesity.com
Detected libraries:
jquery - 1.5 : (active1) -http://arabobesity.com/js/jquery-1.5.min.js
Info: Severity: medium
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4969
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
jquery - 1.5 : (active1) -http://arabobesity.com/js/jquery-1.5.min.js
Info: Severity: medium
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4969
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
2 vulnerable libraries detected
Content returned see: https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2Farabobesity.com&ref_sel=GSP2&ua_sel=ff&fs=1
See: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Farabobesity.com
See: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fgqillqigqilqigqiqlqiigqilqiiiqgg.esmtp.biz%2F1.php+
Please contact the Certificate Authority for further verification.
Warnings
RC4
This server uses the RC4 cipher algorithm which is not secure. Disable the RC4 cipher suite and update the server software to support the Advanced Encryption Standard (AES) cipher algorithm. Contact your web server vendor for assistance.
Root installed on the server.
For best practices, remove the self-signed root from the server.
See: http://www.rexswain.com/cgi-bin/httpview.cgi → Maximum execution time of 15 seconds exceeded!
Re: https://www.mywot.com/en/scorecard/204.16.169.2?utm_source=addon&utm_content=rw-views
Listed on the Zeus tracker IP blocklist.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist - → https://www.virustotal.com/en/ip-address/204.16.169.2/information/
→ https://www.threatminer.org/host.php?q=204.16.169.2 → http://cyberwarzone.com/malicious-history-of-204-16-169-2/ →
- https://malwr.com/analysis/NmUxNWY2ZTU4ZjA3NDQ1NGI3NmYyYWE1NzZlZjI4ZDU/ kicks up a VBS:Dropper-JM[Trj] in the browser executable,
do not visit that last link as it apparently shows to much of the malcode not to make avast alert.
Where avast should detect VBS:Banker-DM [Trj]
polonus (volunteer website security analyst and website error-hunter)