what are this site infected with?

[system]

xxx://www.dixvi.com/

avast spamming pop-ups

[mikaelrask]

hey

https://www.virustotal.com/url/eb659c0a8463df4794289d14dd4c61dbc4eb132468598580db0fe119b913ef6b/analysis/ on thret according to virustotal. might be something in the code avast do not like. might needs further investigation.

[Pondus]

what does the avast pop-up say… post a screenshot

Sucuricata and Snort filters alert. http://urlquery.net/report.php?id=211718

[DavidR]

@mikaelrask post:2

hey

https://www.virustotal.com/url/eb659c0a8463df4794289d14dd4c61dbc4eb132468598580db0fe119b913ef6b/analysis/ on thret according to virustotal. might be something in the code avast do not like. might needs further investigation.

The virustotal URL scan is poor at best and useless at worst as it isn’t doing a real-time scan of the site, just appears to be checking database listings for entries, so are also very old entries. So for stuff like this you have to check real-time scanners like Sucuri and urlquery, etc.

Given what the site content is, I wouldn’t be too surprised as p-o-r-n is a huge target for malware. There are also numerous redirects on the site so it wouldn’t be too hard to have the link land up on a malicious page.

[polonus]

Hi DavidR,

Site’s rel canonical tag pointing to another domain, that is a suspicious sign.
Bitvertiser google redirect virus infected, read: http://www.pchell.com/support/bidvertiser_redirect.shtml (article author = Mark Hasting)
(iframe) bdv.bidvertiser dot com/bidvertiser dot dbm

polonus

[mikaelrask]

@DavidR post:4

@mikaelrask post:2

hey

https://www.virustotal.com/url/eb659c0a8463df4794289d14dd4c61dbc4eb132468598580db0fe119b913ef6b/analysis/ on thret according to virustotal. might be something in the code avast do not like. might needs further investigation.

The virustotal URL scan is poor at best and useless at worst as it isn’t doing a real-time scan of the site, just appears to be checking database listings for entries, so are also very old entries. So for stuff like this you have to check real-time scanners like Sucuri and urlquery, etc.

Given what the site content is, I wouldn’t be too surprised as p-o-r-n is a huge target for malware. There are also numerous redirects on the site so it wouldn’t be too hard to have the link land up on a malicious page.

ok i got it. thanks for the information DavidR