There are two sorts of main website attacks that fall into two categories mainly,
one category as alerted below, a so-called “MS Blue E exploit”,
and the other one that falls into the category “another darned trojan”!.
See here: http://urlquery.net/report.php?id=8789858
IDS alert here for ETPRO WEB_CLIENT Microsoft Internet Explorer remote code execution via option element
(IDS alert id 2803851 which comes in the web client rule cat.)
Here site is been given secure or cleansed? https://www.virustotal.com/nl/url/ee1e84b176d908ec0bf415ffc7cca0262a9c3d90c09d0721c18069e6ce0f5a82/analysis/1389539180/
See also: http://jsunpack.jeek.org/?report=87ca283e6635550730813187741c18e52f1838f7
Found to be benign here: http://zulu.zscaler.com/submission/show/52eb8ba2344efabab6631d2d6f7e7875-1389540566
What is the verdict> The above-mentioned site has very weak defenses against malcode in Zpanel’s templateparser.class.php,
an arbitrary (PHP) code execution exploit that Zpanel developers have not patched yet, I won’t go into details naturally.
Detection credits for this vulnerability goes to Secunia’s Sven Slootweg.
Also consider my previous analysis of such an IDS alert here: http://forum.avast.com/index.php?topic=129491.0
with another exploitable configuration
due to software behind nginx/1.0.0 a Ruby application run on Phusion Passenger
a known misconfiguration for + Phusion Passenger 3.0.7 (mod_rails/mod_rack) which can give away private information
polonus