MBP#1

---------------------------------------------------------------------------------------------------
Previous:

https ://archive .org/details /atomicnucleus032805mbp
linked by ManBearPig @ http://enenews.com/govt-issues-inundation-warning-fukushima-daiichi-years-strongest-storm-approaches-tepco-bracing-overflows-officials-warn-torrential-rains-landslides-ground-loosening-south-plant-danger-tornad/comment-page-3#comment-588156
2/61 detections via https://www.virustotal.com/en/url/e5963b3d2e8f5242d43fb74af049a822d9cf7a6dee9c7e8642c08fdb63337d80/analysis/1416048420/
Quote:  "Blueliv 	 	Malicious site
Malware Domain Blocklist 	Malicious site"
---------------------------------------------------------------------------------------------------

Do bear in mind that none of this should be considered "actionable" until confirmed.
No sense going off half-Vox'ed.  :lol

Here's an update to the last candidate link, which only scored as a "Malicious site" on 2/61 URL Scanners:
http://quttera.com/detailed_report/archive.org
Quote from "Blacklisting status" --> "Quttera Labs - domain is Malicious. more info"
That site is long on blacklists, but damn short on details.  (Inconclusive)


Here is another candidate (with spaces for sanity's sake):
http ://www.uefap .com /reading /exercise /ess3 /gamow .htm

posted:  http://enenews.com/govt-issues-inundation-warning-fukushima-daiichi-years-strongest-storm-approaches-tepco-bracing-overflows-officials-warn-torrential-rains-landslides-ground-loosening-south-plant-danger-tornad/comment-page-3#comment-588284

Analysis:  https://www.virustotal.com/en/url/d2e8d4d5534b9d4ddc16c0599f426eb971bb2af3ea84de6e05da8a68fbf138fc/analysis/1416050535/
That registers 1/61 detection as a "Malware Site".

http://sitecheck.sucuri.net/results/www.uefap.com

Quote:  "Website: 	www.uefap.com
Status: 	Site Potentially Harmful. Immediate Action is Required.
Web Trust: 	Blacklisted (10 Blacklists Checked): Indicates that a major security company (such as Google, McAfee, Norton, etc) is blocking access to your website for security reasons. Please see our recommendation below to fix this issue and restore your traffic."
...
"Site Likely Compromised"..."Outdated Web Server Apache Found: Apache/2.2.3"
...
"Domain blacklisted By Yandex (via Sophos): uefap.com - reference"

Reference:  http://www.yandex.com/infected?url=uefap.com&l10n=en
Quote:  "Yandex has detected malware on this site that may harm your computer or gain access to your personal information."

Interesting that only a Russian site puts up red flags.
Translated Quote:  "Yandex periodically checks the page. Last check (less than a week ago) has shown that the site was placed malicious code. This could happen as desired site owners and without their knowledge - as a result of malicious acts. If at the next check code is detected, Yandex stops mark the site in search results as dangerous."
...
"Malware:  contains Troj/JSRedir-NG (data provided by Sophos)."
https://nakedsecurity.sophos.com/2009/12/23/gnu-gpl-malware-trojjsredirak/
Title:  "GNU GPL malware?: Troj/JSRedir-AK" ... "by SophosLabs on December 23, 2009"

Dud here:  Note the differing suffixes.

Quote:  "The next few lines of code do the redirection to a webpage in Russia with the following legitimate strings in its URL:

    google-com-ar
    google.ch
    google.com
    mininova.org
    cams.com
    ip138-com

I suspect that this code is part of a larger hack and if you find this code on your website please send us samples of other recently modified files."

Dud here:  There might be your Russian web traffic.

see http://en.wikipedia.org/wiki/Gumblar

Quote:  "Gumblar is a malicious Javascript trojan horse file that redirects a user's Google searches, and then installs rogue security software. Also known as Troj/JSRedir-R this botnet first appeared in 2009."
...
"Gumblar.X infections were widely seen on systems running older Windows operating systems.[2] Visitors to an infected site will be redirected to an alternative site containing further malware. Initially, this alternative site was gumblar.cn, but it has since switched to a variety of domains. The site sends the visitor an infected PDF that is opened by the visitor's browser or Acrobat Reader. The PDF will then exploit a known vulnerability in Acrobat to gain access to the user's computer. Newer variations of Gumblar redirect users to sites running fake anti-virus software."

Dud here:  There is your fake security software via a malicious pdf.

Quote:  "See also:    Malware, E-mail spam, Internet crime"