Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: 00000027.0x00000000000585a98
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 03 Oct 2015 13:03:35 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.4.42 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips mod_perl/2.0.4 Perl/v5.10.1
Content-Type: text/html; charset=UTF-8
X-Pingback: http://00000027.0x00000000000585a98/xmlrpc.php
X-Powered-By: PHP/5.4.42
GET / HTTP/1.1
Host: 00000027.0x00000000000585a98
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 03 Oct 2015 13:03:35 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.4.42 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips mod_perl/2.0.4 Perl/v5.10.1
Content-Type: text/html; charset=UTF-8
X-Pingback: http://00000027.0x00000000000585a98/xmlrpc.php
X-Powered-By: PHP/5.4.42
Second query (visit from search engine):
GET / HTTP/1.1
Host: 00000027.0x00000000000585a98
Referer: http://www.google.com/search?q=00000027.0x00000000000585a98
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: 00000027.0x00000000000585a98
Referer: http://www.google.com/search?q=00000027.0x00000000000585a98
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
Request | Server response | Status |
http://00000027.0x00000000000585a98/ | 200 OK Content-Length: 31385 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/wp-includes/js/jquery/jquery.js?ver=1.11.2 | 200 OK Content-Length: 95952 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 | 200 OK Content-Length: 7200 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-content/themes/mixed/js/smoothscroll.js?ver=4.2.5 | 200 OK Content-Length: 7391 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-content/themes/mixed/js/slider.js?ver=4.2.5 | 200 OK Content-Length: 31605 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-content/themes/mixed/js/fitvids.js?ver=4.2.5 | 200 OK Content-Length: 2781 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-content/themes/mixed/js/general.js?ver=4.2.5 | 200 OK Content-Length: 419 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/wp-content/themes/mixed/js/mixed.js?ver=4.2.5 | 200 OK Content-Length: 1411 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/%e3%82%ab%e3%83%81%e3%83%89%e3%82%ad%e3%83%95%e3%83%a9%e3%83%83%e3%83%88%e3%82%b7%e3%83%b3%e3%82%ab%e3%83%bc-m-0-17-s249201191--14923.html | 200 OK Content-Length: 21822 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/wp-includes/js/comment-reply.min.js?ver=4.2.5 | 200 OK Content-Length: 757 Content-Type: text/javascript | clean |
http://00000027.0x00000000000585a98/author/admin | 200 OK Content-Length: 31647 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/%e3%82%a8%e3%82%b3%e3%83%90%e3%82%ad%e3%83%a5-%e5%b0%82%e7%94%a8%e3%83%91%e3%83%83%e3%82%af%e3%82%bb%e3%83%83%e3%83%88-k010502537--14921.html | 200 OK Content-Length: 26911 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/category/%e3%83%af%e3%82%a4%e3%83%b3/%e3%82%aa%e3%83%bc%e3%82%b9%e3%83%88%e3%83%aa%e3%82%a2/%e3%82%b2%e3%82%bc%e3%83%ab%e3%83%9e%e3%83%b3 | 200 OK Content-Length: 32273 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/%e3%80%90%e9%80%81%e6%96%99%e7%84%a1%e6%96%99%e3%80%91%e3%80%8a-%e3%82%bb%e3%83%83%e3%83%88%e8%b2%a9%e5%a3%b2%ef%bc%9a12%e5%80%8b-%e3%80%8b%e3%80%90%e3%83%9d%e3%82%a4%e3%83%b3%e3%83%882%e5%80%8d-2--14919.html | 200 OK Content-Length: 28132 Content-Type: text/html | clean |
http://00000027.0x00000000000585a98/tag/%e3%82%b7%e3%83%aa%e3%83%b3%e3%83%80%e3%83%bc%e5%8d%97%e4%ba%ac%e9%8c%a0 | 200 OK Content-Length: 23820 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=00000027.0x00000000000585a98
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://00000027.0x00000000000585a98/
Result: 00000027.0x00000000000585a98 is not infected or malware details are not published yet.
Result: 00000027.0x00000000000585a98 is not infected or malware details are not published yet.