Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

How do I test if a Link is REALLY malicious or not ? I use VirusTotal, but I suspect that it is not useful at all. To see why, please read further.

I wanted to find out which side the stomach is on. So, i went to wiki answers http://wiki.answers.com/Q/What_side_is_the_stomach_on. On the top right corner, I accidentally clicked an ad which looks like a boxing game. It took me to a website which looks like a "spin the wheel game". This is the URL, which i obfuscated using @@@ - http:@@@//@@@ @@@winspinwin.net@@@/@@@spinner@@@/@@@freespin.php?

I used VirusTotal URL Scanner to scan the wiki page and the url of the ad, it was all clean. But, I suspect that it is not. It could have been a drive by :(

Is there any way to be sure that visiting the link did not harm me ?

share|improve this question

1 Answer

up vote 2 down vote accepted

It is possible that malware websites are evading detection from malware scanners by looking at the source IP address and offering a clean version of the website to the malware scanner. Virus Total being the most popular scanner, the chances are high.

The next easy option is to scan it with Google Safe Browsing like this: 

http://www.google.com/safebrowsing/diagnostic?site=http://winspinwin.net/spinner/freespin.php

But if you use Chrome or Firefox, the browser already did that for you.

A different option is to use an antivirus product on your machine while accessing that website.

A more lucrative but safe option is to install a virtual machine with the same OS and browser you use and visit that site while running Process Monitor. This way you can see any suspicious processes, file and registry writes.

I checked using a vulnerable IE 6 and your page looks benign.

share|improve this answer
Are there any alternatives to process monitor ? Also, I guess can we prevent malicious websites from detecting the scanners IP. Why not make a Virtual machine (rented on amazon aws) send requests for that page ? Sounds possible ? – FirstName LastName Jan 13 at 18:54
Filemon and Procmon have been united into Process Monitor. Although Virus Total has been acquired by Google, the service runs millions of URL scans per day and could not afford to run each scan from a different IP address. If it had 1000 IP addresses, a malware author would have to scan an URL a few thousand times to discover all the scanner IPs. – Cristian Dobre Jan 13 at 19:20
About the Virus Total acquisition - damn ! The concept was not exactly inconceivable. Never expected VT to be so valuable. Was thinking of making such a website myself...too late i guess. :) – FirstName LastName Jan 14 at 5:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.