This phishing site detected?

polonus · 2015-09-21T11:38:48.000Z

See: https://www.mywot.com/en/scorecard/pt-smu.com?utm_source=addon&utm_content=popup
vry poor web rep.
See: https://www.virustotal.com/nl/url/cab5931954688d83f49fee7e68c5a27a074c8182b37032b0f64aef1243acbfb2/analysis/1442834750/
Consider: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fpt-smu.com%2Fl%2Fr.php
WordPress Plugins
The following plugins were detected by reading the HTML source of the WordPress sites front page.

photo-gallery 1.2.4 latest release (1.2.59) Update required
https://web-dorado.com/products/wordpress-photo-gallery-plugin.html
revslider

WordPress Theme
The theme has been found by examining the path /wp-content/themes/ theme name /

Kora 1.0.4http://themes.muffingroup.com/kora

Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.

ID User Login
1 pt-smu pt-smu
2 None

Warning Directory Indexing Enabled
In the test we attempted to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is an information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

/wp-content/uploads/ enabled
/wp-content/plugins/ disabled

See: http://www.phishtank.com/phish_detail.php?phish_id=3477807

5 malicious files with links to blacklisted domains: -gallerychuan.com.tw & -wagnercontractor.com & -bondstreetdental.com.au

Suspicious file: /embedded-system-design-pdf-download
Severity: Suspicious
Reason: Detected reference to blacklisted domain
Details: Detected reference to suspicious blacklisted domain -castrocastilloandassociates.com

polonus

Pondus · 2015-09-21T15:12:20.000Z

This phishing site detected?

NO https://www.virustotal.com/en/file/7c0bd73dcf6115d6f6031173f9349d7e9de74ef772541e997efc937df9132597/analysis/1442848113/

but most have it on URL block, also Opera browser and MS Edge
https://www.virustotal.com/en/url/cab5931954688d83f49fee7e68c5a27a074c8182b37032b0f64aef1243acbfb2/analysis/1442848174/

polonus · 2015-09-21T20:06:38.000Z

Hej Pondus,

All browser users with Google Safebrowsing running in their browser are being protected.

Damian

Announcements