Bleklistovani domaci sajtovi

[Petar]

http://autoplacevi.rs/
     https://sitecheck.sucuri.net/results/autoplacevi.rs
     https://www.virustotal.com/gui/url/2b411...?nocache=1
   
http://euroguma.rs
    https://www.fortiguard.com/webfilter?q=e...&version=9
    https://www.virustotal.com/gui/url/2b411...je.gov.rs/
   

[maxxa]

Uh lista blacklistovanih je velika
Šta kažu ostali, da za svaki sajt otvaramo novu temu ili da rokamo sve ovde?

[1van]

Kako god vama lakše, čitaju nas svakako

[maxxa]

Ja bih nastavio ovde jer ima toga dosta

[maxxa]

osim euroguma tu je i beoguma:
hxxp[:]//beoguma.com/rs-plugin/js/jquery[.]themepunch[.]revolution[.]min[.]js
hash: B3BE6A5785A68DDF5F708D50ECEB9D52
JS/Agent.PIV trojan

https://www.virustotal.com/gui/url/7a0a5...b98465ff6c

[maxxa]

hxxp[:]//www[.]img[.]rs/js/accordion/custom[.]js
hxxp[:]//www[.]img[.]rs/js/carousel/custom[.]js
hxxp[:]//www.img[.]rs/js/carousel/jquery[.]flexslider[.]js
hxxp[:]//www.img[.]rs/js/carousel/jquery[.]jcar

https://www.virustotal.com/gui/url/50770...ed61b377db

Zanimljivo je da sucuri, urlquery i scumware ne nalaze da je nešto maliciotno, fortiguard kaže Category: Malicious Websites

[maxxa]

hxxp[:]//inter-auto[.]rs/wp-content/plugins/contact-form-7/includes/js/scripts[.]js?ver=4.3.1
JS/Agent.PHC trojan: 54C189361DFCB2224F81F38A521D2440

hxxp[:]//inter-auto[.]rs/wp-content/themes/interauto/js/jquery[.]bxslider[.]min[.]js?ver=4.4.25
JS/Agent.PHC trojan: 5E9747B704DD158CF2DE13705C420601

hxxp[:]//inter-auto[.]rs/wp-content/plugins/contact-form-7/includes/js/jquery[.]form[.]min[.]js?ver=3.51.0-2014.06.20
JS:Trojan.Cryxos.6843: 099FD03DD941CAB737A488E5AEE027E8

hxxp[:]//inter-auto[.]rs/wp-content/themes/interauto/js/jquery[.]fancybox[.]pack[.]js?ver=4.4.25
JS/Agent.PHC trojan: 4060E299A709EC281D882A8F9A71B958

hxxp[:]//inter-auto[.]rs/wp-content/themes/interauto/js/jquery[.]bxslider[.]min[.]js
JS/Agent.PHC trojan: 5E9747B704DD158CF2DE13705C420601

https://www.virustotal.com/gui/url/92f18...75fda5fa4d

[Petar]

flylondonsrbija[.]rs

https://urlscan.io/result/63745e4c-293f-...3f021b81b/ kako izgleda
https://www.virustotal.com/gui/domain/fl...nsrbija.rs
--- sporni fajlovi:
      /runtime-es5.648fda581d7a6cd478a6.js
      /polyfills-es5.5e657f60015c1df344ba.js
      /polyfills-es2015.1c036d218568a752e64f.js
      /main-es2015.165e48017044d4593db0.js
      /main-es5.165e48017044d4593db0.js

https://www.fortiguard.com/webfilter?q=f...&version=9


   

[Petar]

http: // www.vakel[.]rs

"Error: TLS certificate does not match the host name"
Outdated/vulnerable Apache

https://www.virustotal.com/gui/url/ce218...?nocache=1
https://sitecheck.sucuri.net/results/vakel.rs

   

https://threatcenter.crdf.fr/check.php

   

Webroot:

   

[Petar]

IMPULSCENTAR [.] RS

https://sitecheck.sucuri.net/results/IMPULSCENTAR.RS
https://www.virustotal.com/gui/url/58dc1...d5491c6232

webroot:
   

Dosta cudnih JS funkcija.
Veroratno je potrbna dodatna dublja analiza.
https://urlquery.net/report/31eb0c97-689...0e59bb5fbe

Anyrun ne prepoznaje ni jedan tip iz Mitre&ATT&CK matrice sto je veoma redak slucaj, meni je ovo dosta sumnjivo jer moze znaciti da namerno sve napravljeno da bas ove tehnike moze zaobici.