Site not blocked!

Viruses and worms
1

02718(dot)ru/

Related to the RBN.
http://urlquery.net/report.php?id=1398623538858

Sites on same IP:
http://urlquery.net/report.php?id=1398623621267
http://urlquery.net/report.php?id=1398623697356
http://urlquery.net/report.php?id=1398623846062
http://urlquery.net/report.php?id=1398623286405
http://urlquery.net/report.php?id=1398623441695

Blacklisted by Dr. Web
http://www.urlvoid.com/scan/02718.ru/

VT Report: Dr. Web only source blocking… https://www.virustotal.com/en/url/e205f3473592cc869171751b38192715d3cee44d898fc16043073e1373258b6e/analysis/1398623941/

Sucuri Missed it totally: http://sitecheck.sucuri.net/results/02718.ru/

Zulu: 32/100 Malicious… http://zulu.zscaler.com/submission/show/6e88b4c561a47ba85b14be7dce35c923-1398623948

All of the (Current) ASN is considered to be apart of RBN Network IP 375

2

IP badness history: https://www.virustotal.com/nl/ip-address/91.202.63.44/information/
AS has various infesction of JS.Loadpays.2
Kraken’s Virus Tracker comes with the following domain classification: 02718 dot ru,91.202.63.44,ns1.vivapays dot com,Criminals,
meaning there is live and up malware there.
Contradictory WOT results: https://www.mywot.com/en/scorecard/02718.ru

Microsoft Pocket Internet Explorer (PIE) is vulnerable to a denial of service attack, caused by improper handling of JavaScript in Web pages!
Site has htxp://02718.ru/design/js/PIE.js

Excessive header information: http://fetch.scritch.org/%2Bfetch/?url=02718.ru&useragent=Fetch+useragent&accept_encoding=

Google Browser diff: Not identical

Google: 34535 bytes Firefox: 34724 bytes
Diff: 189 bytes

First difference:
ð°ñ�ð¾ð½ ð½ðµð¾ð±ñ�ð¾ð´ð¸ð¼ð¾ ð¾ñ�ð¿ñ�ð°ð²ð¸ñ�ñ� ñ�ð¼ñ�-ñ�ð¾ð¾ð±ñ�ðµð½ð¸ðµ ñ� ñ�ðµðºñ�ñ�ð¾ð¼ ð¡ð¢ð�ð� 2974 ð½ð° ð½ð¾ð¼ðµñ� 5051 (ð±ðµñ�ð¿ð»ð°ñ�ð½ð¾).

<...

Evidence site has been compromised: htxp://02718.ru/test404page.js → htxp://02718.ru/notfound/

Malware for AS: http://www.malwareurl.com/ns_listing.php?ns=ns2.vivapays.com

polonus

3

So definently needs to be blocked ASAP…

4

I did not find any malicious activity myself, but I blocked it:-).

5

Hi Hondaz, If you look at URLQuery Report, Under the IP reports, Every site there is tied to the RBN, which should be cause for a IP blacklist.