SE redirection or not?

polonus · 2015-04-26T12:30:04.000Z

See: http://killmalware.com/baumsanierung.com/#
Not detected: https://www.virustotal.com/nl/url/307c77050fa9048c397fae1caac51edf4d90a25a7d80eccf129485e8844ab892/analysis/1430050022/
nor: https://sitecheck.sucuri.net/results/baumsanierung.com#sitecheck-details
Linked Javascript
jscript/reiter.js
jscript/add_event.js
jscript/popup.js
js/jquery-1.9.1.js
js/jquery-ui-1.10.3.custom.min.js → http://fetch.scritch.org/%2Bfetch/?url=http%3A%2F%2Fbaumsanierung.com&useragent=Fetch+useragent&accept_encoding=

Only Quttera detects here 1 suspicious file:
index
Severity: Suspicious
Reason: Detected suspicious redirection to external web resources at HTTP level.
Details: Detected HTTP redirection to htxp://terratextura.de/?contentID=31.
File size[byte]: 0
File type: Unknown
Page/File MD5: 00000000000000000000000000000000
Scan duration[sec]: 0.001000

Also PHISHing domains on same IP: https://urlquery.net/report.php?id=1430051314942 → ->
https://urlquery.net/report.php?id=1429495561488

URLs found in the page: URL - Times Found
Found 28 urls from where 25 unique.
-http://baumsanierung.com/?contentID=18 - 2
-http://baumsanierung.com/img/seiten/terratextura/startseite/kundenanforderungen_gr.gif - 2
-http://baumsanierung.com/favicon.gif - 2

1
-http://baumsanierung.com/?contentID=14 - 1
-http://baumsanierung.com/?contentID=55 - 1
-http://baumsanierung.com/index.php?contentID=56 - 1
-http://baumsanierung.com/?contentID=28&newsID=2#anker2 - 1
-http://baumsanierung.com/?contentID=17 - 1
-http://baumsanierung.com/?contentID=16 - 1
-http://baumsanierung.com/?contentID=3 - 1
-http://baumsanierung.com/css/basic.css - 1
-http://baumsanierung.com/?contentID=2 - 1
-http://baumsanierung.com/druckversion.php?contentID=1&send= - 1
-http://baumsanierung.com/?contentID=20 - 1
-http://baumsanierung.com/?contentID=54 - 1
-http://baumsanierung.com#top - 1
-http://baumsanierung.com/?contentID=1 - 1
-http://baumsanierung.com/?contentID=15 - 1
-http://baumsanierung.com/css/terratextura/jquery-ui-1.10.3.custom.min.css - 1
-http://baumsanierung.com/?contentID=4 - 1
-http://baumsanierung.com/?contentID=28&newsID=4#anker4 - 1
-http://baumsanierung.com/?contentID=29 - 1
-http://baumsanierung.com/?contentID=28&newsID=5#anker5 - 1
-http://baumsanierung.com/?contentID=19 - 1

Found easy peasy: htxp://baumsanierung.com/admin/

polonus

Asyn · 2015-04-26T12:44:04.000Z

→ http://zulu.zscaler.com/submission/show/85abe8ce12961b6cf14fcea9bfb21ca6-1430051596
→ http://zulu.zscaler.com/submission/show/6f05323535de862002f2a7d243969cb2-1430051606
→ http://zulu.zscaler.com/submission/show/b3eccdc1fb0bbe3e13f4efbf81f76440-1430051873

polonus · 2015-04-26T12:52:02.000Z

Hi Asyn,

Spam report on IP: http://www.abuseipdb.com/report-history/81.169.145.78
I think for SE redirect detections Zulu Zscaler does not scan deep enough.
Heading Tags found on page:

Technische Informationen

Aktuelles

TerraTextura

terraXit-Produkte und -Systemlösungen

Neue Produkte f�r die Verkehrs�fl�chenbegr�nung/Aktivierung des Bodenlebens

TerraTextura auf der GaLaBau 2010

Nachlese GaLaBau 2010

Fremdnutzung von Marken der TERRA TEXTURA Baustoff- und Vegetationstechnologie GmbH

Meta tags analysis.
Title: Title contains no errors.
This tag contains 51 characters.
Title relevancy to page content is excellent.
The Title relevancy to page content is 100%.
Description: Found no description meta tag.
The description meta tag is used by most of the search engines. Consider to add a description meta tag.
Author: The Author meta tag contains no errors.
This tag contains 87 characters.

Damian

Announcements