Advice Request A site only detected by Kaspersky and Netcraft

[JB007]

Hello,
It will be Christmas soon, so I'm going to buy a few bottles of Champagne and one of the site I want to visit was blocked by Netcraft and Kaspersky. I checked iit with VT but it was not detected by other Antivirus

VirusTotal

VirusTotal

www.virustotal.com

And SUCURI says that this site is clean...

 

[bayasdev]

Pay with PayPal, if something goes wrong ask for a refund. If the website was compromised in any way they won't get your CC data.

Make sure that the PayPal website is the real one.

 

[L0ckJaw]

Norton detects it .

 

[JB007]

Pay with PayPal, if something goes wrong ask for a refund. If the website was compromised in any way they won't get your CC data.

Make sure that the PayPal website is the real one.

Are you sure that it is enough to protect?

 

[oldschool]

Find another site. I trust K and Netcraft. It's Christmas time and Phishing Time. I've tested lots of phishing links lately and the phishers have gotten very good with their replication/infestation of sites.

 

[Gandalf_The_Grey]

Holiday season is also a feast for shopping skimmers. If Kaspersky and Netcraft block that site I would buy my champagne elsewhere.
Like @oldschool says: why take the risk?

 

[oldschool]

This was just posted Security Alert - Hundreds of Counterfeit Sneaker Sites Hacked to Steal Credit Cards

 

[plat]

Indeed, Norton SafeWeb detected it in Edge.old browser. However, I want Champagne. So, I bypassed Norton, which then offered Isolation Mode if I signed into my Norton acct. (don't got one). So I skipped that, thinking the site would load. Instead, got this:

Spoiler

Check out the URL on that page, where I'd originally typed: xxx.champmarket.com Great reminder about phishing and skimming, guys! Hopefully, this is the closest any of us will ever come.

 

[Threadripper]

 

[Venustus]

As others have said be very careful about any online transactions on that site!

 

[upnorth]

Perfect example where a small guide like this might come in handy.

Holiday Scam Season Is Here for All Shoppers

The holiday shopping season is in full swing, with Black Friday and Cyber Monday just around the corner, and scammers have been getting ready to cash in from their fraud campaigns. While some fraudsters target the online landscape fooling shoppers with lookalike domains, others focus on...

malwaretips.com

I did the basic check for you @JB007 and to start with, very nice site just not sure they deliver to Sweden.

The site/domain itself. This been around since 2010 and I can't see anything shady with the registrar etc.

What I'm personal not too fond off, is their use of a CMS platform. In this case Magento but, I can't say for sure if they at least run the latest version as that's crucial.

For more information on " Magecart " attacks, MTs news forum/section is a great start.

Search results for query: magecart

malwaretips.com

One can also send the url/link to several AV vendors to try get a better answer but, as the malicious scripts comes and goes and it's impossible to predict exactly when and when even obfuscated as for example legit Google scripts, I would rather suggest/advise a few things first that works much better.

1. If you must buy from this site, make an order if possible through there phone number that's clearly shown on all pages in the top right corner.
2. If you still want to buy online, try use in first hand a so called pre-paid debit card or, enable security settings on your banks site if available.
3. Shop the bottle/s physical from a local store as then you also don't need to worry about any late delivery.

Good luck @JB007 and hope you can enjoy your champagne soon.

 

[SeriousHoax]

It seems the site itself could be safe but it loads a third party script which is the culprit here. But that domain is down so it's not able to load the script anyway.

I don't know whether the site has been compromised or they deliberately added this but it's better not to purchase anything from here just to stay safe.
Another example of the usefulness of script blocking extensions like: uMatrix, NoScript, ScriptSafe, uBlock Origin in medium/hard mode, etc.
VT report of the third party script site: VirusTotal

 

[Mercenary]

ESET Internet Security 13 and Emsisoft Anti-Malware don't see anything dangerous.

 

[ForgottenSeer 823865]

Two alerts, enough for me to leave this sites forever.

@JB007 Carrefour est ton ami MDR ^^

 

[oldschool]

FYI: Edge Chromium gives "Insecure content blocked" message in address bar, unlike the full screen alert from Netcraft.

 

[fabiobr]

It seems the site itself could be safe but it loads a third party script which is the culprit here. But that domain is down so it's not able to load the script anyway.
View attachment 230920
I don't know whether the site has been compromised or they deliberately added this but it's better not to purchase anything from here just to stay safe.
Another example of the usefulness of script blocking extensions like: uMatrix, NoScript, ScriptSafe, uBlock Origin in medium/hard mode, etc.
VT report of the third party script site: VirusTotal

Norton blocked Virus Total here hahahahaha

 

[SeriousHoax]

View attachment 230979
Norton blocked Virus Total here hahahahaha

It seems your link has the malicious url in it. It's referring or redirecting towards that site and maybe that's why Norton has blocked it.

 

[notabot]

It seems the site itself could be safe but it loads a third party script which is the culprit here. But that domain is down so it's not able to load the script anyway.
View attachment 230920
I don't know whether the site has been compromised or they deliberately added this but it's better not to purchase anything from here just to stay safe.
Another example of the usefulness of script blocking extensions like: uMatrix, NoScript, ScriptSafe, uBlock Origin in medium/hard mode, etc.
VT report of the third party script site: VirusTotal

The problem is when the page doesn't display correctly or doesn't work properly, in which case you need to enable more scripts and then the user has little clue of whether to enable or not the malicious script, unless they try scripts one by one, starting from same domain, only cautiously expanding to 3rd domains etc -- but this approach is a quite a slow one.

 

[ForgottenSeer 823865]

uMatrix, NoScript, ScriptSafe, uBlock Origin in medium/hard mode. All those are geek toys, far away from Average Joe's skillset.

 

[notabot]

For card skimmers, my solution is simple, only use a card that you can enable & disable ad hoc.
This can either be a virtual card, many banks offer this service these days. Something like Revolut also does the trick.

Enable the card, buy what you want ( provided it's not a subscription ) and after the transaction is cleared disable the card. It's 100% skimmer proof.