What malware flagged here?

Re: https://urlquery.net/report/f58ae375-aa42-499d-9550-a1b087249411
McAfee flags for PUP - suspicious link, Fortinet’s blacklisted website.

CMS issues: WordPress Plugins
The following plugins were detected by reading the HTML source of the WordPress sites front page.

duracelltomi-google-tag-manager 1.5.1 latest release (1.7.1) Update required
https://duracelltomi.com/google-tag-manager-for-wordpress/
search-filter-pro
uk-cookie-consent 2.3.0 latest release (2.3.4) Update required
http://catapultthemes.com/cookie-consent/
edd-aelia-currencyswitcher
pricing-table latest release (1.5.0)
http://wpeden.com/product/wordpress-pricing-table-plugin/
edd-wish-lists
edd-ajax-filters 1.0.0 latest release (1.0.4) Update required
https://wordpress.org/plugins/edd-ajax-filters
easy-digital-downloads latest release (2.8.6)
https://easydigitaldownloads.com
edd-advanced-product-labels
popup-maker 1.6.5 latest release (1.6.6) Update required
https://wppopupmaker.com/
Plugins are a source of many security vulnerabilities within WordPress installations, always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes.

This is third party code - hxtps://a.optnmnstr.com/app/js/api.min.js?ver=1.1.6.1
Subresource Integrity (SRI) not implemented, but all external scripts are loaded over https
NetDNA-cache/2.2 exploit has a cache managing issue!
-http://b.gtld-servers.net/ open to DNS hijacking: →
https://forum.directadmin.com/archive/index.php/t-43533.html

Exploit arlier alerted for by me here: https://forum.avast.com/index.php?topic=191657.0 (pol).

Website not being flagged here: https://www.quttera.com/detailed_report/www.brandaisy.com

Nameservers: Some of the name servers’ versions found
-ns1.uniregistry-dns.net. Version IPv4: 9.8.4-rpz2+rl005.12-P1
-ns1.uniregistry-dns.com. Version IPv4: 9.8.4-rpz2+rl005.12-P1
-ns2.uniregistry-dns.net. Version IPv4: 9.8.4-rpz2+rl005.12-P1
-ns2.uniregistry-dns.com. Version IPv4: 9.8.4-rpz2+rl005.12-P1

Re: http://www.domxssscanner.com/scan?url=https%3A%2F%2Fwww.brandaisy.com%2F
1 blacklisted hostname detected…

jQuery vuln. library: http://retire.insecurity.today/#!/scan/5ce440d16b3c7dec21e3e6be924e1afbd3e97a9af730e929eb9cea8f416ecedb

F-grade status and recommendations: https://observatory.mozilla.org/analyze.html?host=brandaisy.com

IP resolves to: -https://www.gigrev.com/ OK → http://toolbar.netcraft.com/site_report?url=https://www.gigrev.com

polonus (volunteer website security analyst and website error-hunter)

Additionally I give: https://urlscan.io/result/8bbb3ce0-e889-44b2-a0a9-3255cad5930d#summary
and https://webcookies.org/cookies/brandaisy.com/9050361

HTTP to HTTPS redirect: Warning

Requested URL: htxp://brandaisy.com/ | Response URL: htxps://www.brandaisy.com/ | Page title: Brandable domain names - The marketplace for premium domains. | HTTP status code: 200 (OK) | Response size: 361,070 bytes (gzip’d) | Duration: 2,875 ms
Overview
When a website redirects the user from an HTTP address to an HTTPS one, there is a risk that an attacker could launch a man in the middle attack by intercepting the original HTTP request and returning a malicious response.

Secure cookies: Warning

Requested URL: htxps://www.brandaisy.com/trace.axd | Response URL: htxps://www.brandaisy.com/trace.axd | Page title: Page not found - Brandaisy | HTTP status code: 404 (Not found) | Response size: 47,035 bytes (gzip’d) | Duration: 603 ms
Overview
Cookies served over HTTPS but not flagged as “secure” may be sent over an insecure connection by the browser. Often this may be a simple request for an asset such as a bitmap file but if it’s on the same domain as the cookie is valid for then it will be sent in an insecure fashion. This poses a risk of interception via a man in the middle attack.

Result
It looks like a cookie is being served over HTTPS without the “secure” flag being set (name : value):

aelia_cs_selected_currency : USD
Unless the cookie needs to be sent over an insecure connection, the “secure” flag should always be set to ensure it can only be sent with an HTTPS request.

Result
The address you entered makes a request using the HTTP scheme but is then redirected by the server to an HTTPS address. Consider user education to ensure the HTTPS address is entered directly into the browser when requesting the site.

Clickjacking: Warning

Requested URL: htxp://brandaisy.com/ | Response URL: hxtps://www.brandaisy.com/ | Page title: Brandable domain names - The marketplace for premium domains. | HTTP status code: 200 (OK) | Response size: 361,070 bytes (gzip’d) | Duration: 2,875 ms
Overview
Websites are at risk of a clickjacking attack when they allow content to be embedded within a frame. An attacker may use this risk to invisibly load the target website into their own site and trick users into clicking on links which they never intended to. An “X-Frame-Options” header should be sent by the server to either deny framing of content, only allow it from the same origin or allow it from a trusted URIs.

Result
It doesn’t look like an X-Frame-Options header was returned from the server which means that this website could be at risk of a clickjacking attack. Add a header to explicitly describe the acceptable framing practices (if any) for this site.

polonus

In the code found script of this third party - line 4437 etc.

Website is insecure by default
80% of the trackers on this site could be protecting you from NSA snooping. Tell -optinmonster.com to fix it.

Identifiers | All Trackers
Insecure Identifiers
Unique IDs about your web browsing habits have been insecurely sent to third parties.

c22b625f94ce9b456550ebf299e3ae82 -optinmonster.com srv_id
Legend
Tracking IDs could be sent safely if this site was secure.
Tracking IDs do not support secure transmission.

More insecurity on cookies there - https://webcookies.org/cookies/optinmonster.com/1324486
Pagely Gateway/1.45 cookie server info proliferation - server exploitable is a concern.

Read: https://pagely.com/blog/2017/05/php-object-injection-insecure-unserialize-wordpress/
You do not wanna see this: https://affiliates.siteground.com/login.htm
Good user enumeration is not enabled here at SingleHop, Inc… :o (under maintanace)…yTl2Q7kCgjo8xk-pSXNMuK4hXRk ???

pol