Quote:
Originally Posted by Ravenheart
|
traffurl.ru seems quite a familiar domain on google with lots of queries and dodgy script compaints - just google "traffurl.ru" but don't panic! I wouldn't necessarily follow all the urls given on the various forums as they include hacker sites.
I'm using Norton AV, Sunbelt Counterspy 1.5, and Flashblock- no warnings from them - but as traffurl.ru is on my mvps HOSTS file, it isn't actually getting to do anything anyway as it resolves to 127.0.0.1.
also running FF and Adblock and NoScript.
Page Source shows me an obfuscated script right at the bottom of the page, underneath the </body> and </html> tags.
script>eval(unescape(etc. etc. </script> - that corresponds to what was showing on some of the google entries.
The WHOIS I got on traffurl.ru is
domain: TRAFFURL.RU
type: CORPORATE
nserver: ns2.googleset.info.
nserver: ns1.googleset.info.
state: REGISTERED, DELEGATED
person: Private Person
phone: +7 812 1234567
e-mail:
rekvizitor@gmail.com
registrar: NAUNET-REG-RIPN
created: 2007.12.20
paid-till: 2008.12.20
source: TC-RIPN
Last updated on 2008.04.29 19:57:06 MSK/MSD
Looks like your site may have been got hacked.