IP Address Inspector

L.Nicolai commented...

inetnum: 81.177.141.0 - 81.177.141.255 - CIDR 81.177.141.0/24
netname: AVGURO-NET
route: 81.177.128.0/18

Listed CBL: http://cbl.abuseat.org/lookup.cgi?ip=81.177.141.229
IP Address 81.177.141.229 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.

It was last detected at 2014-10-27 11:00 GMT (+/- 30 minutes).

The IP address 81.177.141.229 corresponds to a web site that is infected with a spam or malware forwarding link.

The website's host name is "babystyle-shop.ru", and this link is an example of the redirect: "http://babystyle-shop.ru/well-behaved.html".

In other words the website "babystyle-shop.ru" has been hacked.
The russian website "http://newworldmayfair.com/" (same IP 81.177.141.229) is used as referer for
broadband-178-140-172-164.nationalcablenetworks.ru - 178.140.172.164 also listed CBL.

The web site "babystyle-shop.ru" may not be familiar to you. This means that another customer of your provider is hosting their web site on the same IP address as you. In that case, you really need to get your provider to assist you.

Usually, the redirect takes the user's browser to a spam or malware site. It's usually fake russian pills or pornography.

Usually, the infection is a Cpanel, Plesk, Joomla or Wordpress CMS install that has become infected either through a vulnerability (meaning the CMS software is out of date and needs patching), or the owner of "babystyle-shop.ru" has had their account information (userids/passwords) compromised. Then malicious software/files are being uploaded by ftp or ssl.
October 27 2014 09:49 AM