The first detection was 3 days ago: http://killmalware.com/baa-corect-moldova.com/#
and http://toolbar.netcraft.com/site_report?url=http://baa-corect-moldova.com
& http://toolbar.netcraft.com/site_report?url=http://217.26.145.207
See: http://www.zone-h.org/archive/notifier=LiOn.HaCkEr
124 websites were thus home-page defaced…directing to file upload site with probably malicious javascript activity:
-http://cdn.top4top.net/i_535fefefd61.jpg → flagged by WOT: https://www.mywot.com/en/scorecard/cdn.top4top.net?utm_source=addon&utm_content=rw-viewsc
Various adware blocked script connections from there:
Scanning -http://cdn.top4top.net/ …
Script loaded: -http://up.top4top.net/ads/adpull.php?n=1&w=728&h=90&call=js&t=banner
Script loaded: -http://up.top4top.net/ads/adpull.php?n=1&w=300&h=250&call=js&t=banner
Script loaded: -https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js
Script loaded: -http://s.top4top.net/styles/default-new-reg/js/the220px.js?rev=18
Script loaded: -http://s.top4top.net/styles/default-new-reg/js/bootstrap.min.js?rev=18
Script loaded: -http://s.top4top.net/styles/default-new-reg/javascript.js?rev=18
Script loaded: -http://www.google-analytics.com/analytics.js
Quttera detects: http://quttera.com/detailed_report/baa-corect-moldova.com
polonus