Site is red ,, please help

[scan718]

I really need help with this,, my site http://topcityelectronics is coming up red, with no explaination other then

http://topcityelectronics.com/

This link might be dangerous. We tested it and found security risks. Beware.

Website Category:

Malicious Sites

Downloads

No downloads found.

Links

No results found.

Feedback

Be the first person to post the comment.

can some one at Macafee help with this, i have sent the email through feed back, tried to leave a comment, (could not) there really must be a faster way for macafee to review sites, as this is really a painfull situation, if any one can see why they would flag it, please chime in as i am lost,,,  i also just opened hosting with godaddy a few days ago, so i dont know if this red flag has been there since then or a long time as i use to foward my site to http://topcityelectronics.zymichost.com/ which terns up green on a search. HELP

[Hayton]

All I can see is that TrustedSource classes it as a Malicious Site.

Possible reason : your site has iframes, which can be hijacked to deliver malware. Perhaps that happened on your site. It's coming up clean at the moment, but if there's some code that only delivers malicious content randomly that clean status could change at any time.

Results from checks -

GoDaddy WhoIs report (basic details, a starting point). GoDaddy servers have been flagged in the past because they host a malicious or hacked website, and then all the other sites are affected by the resulting downgrade of the server's reputation.

http://urlquery.net/report.php?id=4234229

Shows the iframes and what they're delivering at the time of the report (google_ads, betrad, ecrater)

The report also shows two other sites on the same server (rake-take(dot)com and margokelly(dot)info) are flagged for "Malicious CookieBomb javascript". rake-take also has an alert for "obfuscated document command - used in exploit kits".

If more than one site on the server has been hacked then your site is equally vulnerable. Maybe there's something there that the checkers aren't seeing.

Other results :

http://www.urlvoid.com/scan/topcityelectronics.com/

http://www.ipvoid.com/scan/184.168.193.47/

http://siteinspector.comodo.com/public/reports/16148189

Different checkers look for different things. Some only check for spam reports, others look at javascript, and so on.

Message was edited by: Hayton on 30/07/13 23:28:20 IST

[scan718]

i really dont know what to do at this point,   one question though i got someone to the site  with this referer i never saw before

http://192.168.6.249/cgi-bin/tools/loader?url=HTTP%3A%2F%2FTOPCITYELECTRONICS.COM

is this legit????

also, do you think any site i place on that host will also come up red?

Message was edited by: scan718 on 7/31/13 5:17:42 AM CDT

[Hayton]

The referer is apparently legit. Someone on a German site had exactly this question in 2010 (you'll need to translate). The Google-translated explanation boils down to, "don't worry, it's normal".

Shows that GoDaddy is still using CGI scripting on its servers though, and if the server security's not done right an attacker can place executable scripts in the cgi-bin folder. If that's the case then any site on the server is vulnerable.

http://en.wikipedia.org/wiki/Common_Gateway_Interface

http://www.knowledgesutra.com/discuss/fpfmof-cgi-bin-folder.html

[scan718]

Thanks for your help, guess ill just have to wait and see what happens