See: https://urlquery.net/report/037ddee4-ba37-400d-be8a-d082a1b36e26 (Moved permanently?).
95 reports on IP: https://checkphish.ai/ip/185.52.53.247
Reputation Check
PASSED
Google Safe Browse: OK
Spamhaus Check: OK
Compromised Hosts: OK
Dshield Blocklist: OK
Shadowserver C&C: OK
Web Server:
LiteSpeed
X-Powered-By:
None
IP Address:
-185.52.53.247
Hosting Provider:
Phoenix NAP EU B.V.
Shared Hosting:
116 sites found on -185.52.53.247
1 vulnerable jQuery library detected: https://retire.insecurity.today/#!/scan/b8f8c79f9338928d45d36eabdf6bbc28fef9001097e0e8d2c5488e8ab7a4a9fe
How to tackle the WordPress PHP admin-bar vulnerability: https://digwp.com/2011/04/admin-bar-tricks/
also exploitable /wp-includes/SimplePie/Cache.php? an oldie from 2005: https://blog.0x3a.com/post/114659871819/thousands-of-compromised-wordpress-websites
Read: https://www.denisbouquet.com/remove-wordpress-emoji-code/ disable wp-embed.min.js too.
Redirects to -http://www.aaeweb.net/wp-includes/ 9 security recommendations: https://webhint.io/scanner/79fb7b80-c847-481b-a7bd-ebef3812a0f8#Security
Index issues → https://sitecheck.sucuri.net/results/www.aaeweb.net/wp-includes
Leaked PHP version. Site is displaying your PHP version in the HTTP headers on
-https://www.aaeweb.net/404javascript.js and also BIND version: ISC BIND 9.8.2rc1.
Please set expose_php = Off. → https://urlscan.io/result/8f21fe0e-fc30-4a39-ad85-b40ba9e6a1e6
and https://urlscan.io/result/8f21fe0e-fc30-4a39-ad85-b40ba9e6a1e6/dom/
polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)