Yandex and WOT both flag site - avast! does not flag -site clean?

See: http://yandex.com/infected?l10n=en&url=teatr-sovremennik.ru
see: https://www.virustotal.com/en/url/773c6b867642458413bc81b7ea3a1734c948657f1cc7bf67b7ae4ed10617a12e/analysis/
See: http://www.ipvoid.com/scan/81.177.139.151/ (Jino.ru/mod_pizza)
Suspicious: http://zulu.zscaler.com/submission/show/d81371da0b3e14f5b322e4aa378fb9e4-1364679142
(also see: http://jsunpack.jeek.org/?report=e5b36ed4fc461679139273cc76277640bf8b8e7c (link for the security aware only, visit with NoScript and RequestPolicy add-ons active and in a VM (sandbox)) Safe PHISH view: http://support.clean-mx.de/clean-mx/view_evidence?e=old&id=9917174&table=viruses

Same server software can be abused: http://urlquery.net/report.php?id=1672934 (Jino.ru/mod_pizza) ET CURRENT_EVENTS Blackhole 2 Landing Page (5)
For IP consider: http://www.malwaregroup.com/ipaddresses/details/81.177.139.151 (Zeus actvity in the past)

Site not flagged by avast shields, flagged by Bitdefender’s TrafficLight…
ASN report scan: http://urlquery.net/report.php?id=1693278 with Detected suspicious URL pattern for that IP…

polonus

From your first link to yandex:

Yandex periodically checks websites for viruses. The last check (less than three days ago) detected malware on this website. The owner of the site may be completely unaware of any malicious code installed on the site by hackers. If the code is not found the next time the website is checked the tag will be removed.

So the last detection was less than three days ago and avast is a live scan.

WOT is reputation based and I wouldn’t take that at face value either, guidance only.

Hi DavidR,

Well it still is been given as sending live malware (unknown html malware) at clean mx Up(nil): unknown_html RIPE RU abuse at avguro dot com 81.177.139.151 to 81.177.139.151 teatr-sovremennik dot ru htxp://teatr-sovremennik dot ru/ this was at 2013-03-30 01:37:14 CET
The only thing I could do is report to virus AT avast dot com and I just did. Seems the most sensible thing to do and virus analysts there have the last word.
You are right where urlquery dot net does not give any IDS alerts now. There certainly are some baddies on that same IP (with exploit kit launching and exploit kit landing page - Blackhole 2) What abput this one: http://urlquery.net/report.php?id=343594 which also recently has been taken down - I get a 403 error…

403 Ошибка 403. Доступ запрещен

Доступ в эту папку запрещен администратором сайта или в папке нет индексного файла.

Вы можете попробовать вернуться назад или перейти на главную страницу сайта.

Если вы владелец этого сайта, ознакомьтесь с возможными причинами возникновения этой ошибки.

polonus

Also consider the poor senderbase score: http://www.senderbase.org/senderbase_queries.detailip?search_string=81.177.139.151
blocked by cbl.abuseat.org

polonus

Well you could consider requesting it be added to the network shield malicious sites list:

Currently the on-line contact form, http://www.avast.com/contact-form.php?loadStyles doesn’t cater for reporting Undetected malicious/phishing sites only reporting FPs on sites.

Since avast doesn’t specifically have phishing sites on the VPS only malicious/infected sites, there isn’t a specific way to report them for inclusion in the VPS for Network Shield.

Also see http://forum.avast.com/index.php?topic=82635.0, extract below.
Reporting a phishing/malicious/hacked site not detected by the Network/Web Shield/s:
Essentially it is sending an email to virus (at) avast (dot) com (no attachment as there is no physical file) outlining the issue and giving the URL in the body of the email.

The email Subject is probably more crucial as I would say it still has to be called ‘Undetected Malware’ for it to be filtered within the receipt system for action. I would go further and include ‘Network Shield’ in the subject to further define the problem and possibly attract attention. So the subject would be something like “Undetected Malware - Network Shield - Phishing/Malicious site” (whichever is applicable), without the Quotes.

Hi DavidR,

Thanks for the reporting instructions. Try to follow that up,

pol

No problem, that is the thing there is no official means of reporting malicious sites, etc. that really needs to be added to the normal contact form.

Hi DavidR,

Hope that comes in soon. We will put it on our “wish-list” then.
The more users report, the better and fine-tuned avast! detection will get.
I know that is a thing we both are after…

polonus

Follow-up for this thread, because of a site on same server redirecting SE visitors: http://killmalware.com/psxplay.com/
See: https://www.virustotal.com/nb/url/3f1f8a0c742da69b6e618ad2cc66a7ab318e2d74e9bf289dd5689e66bff7aedc/analysis/
1 suspicious file detcted: http://quttera.com/detailed_report/psxplay.com
Detected HTTP redirection to htxp://dapxonuq.ru/count15.php.
Blacklisted and with malware: http://sitecheck.sucuri.net/results/psxplay.com
Older malcode: http://labs.sucuri.net/?malware&entry=2013-04-16
Exploitable server: https://seomon.com/website-technologies/web-servers/Jino.ru%2Fmod_pizza/ SQL exploit via outdated CMS.

polonus