New scan:

Malware Scanner report for 22sisi.comwww.22sisi.com

Malicious/Suspicious/Total urls checked
0/2/4
2 pages have suspicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://www.22sisi.comwww.22sisi.com/
200 OK
Content-Length: 959
Content-Type: text/html
suspicious
Page code contains blacklisted domain: dy.33sisi.com

...[256 bytes skipped]...
com");


urltishi.push("1.22titi.com");
urltishi.push("2.22titi.com");
urltishi.push("3.22titi.com");

for(var i=0;i<urltishi.length;i++){
if (host.indexOf(urltishi[i])>=0){
istishi="1";
}
}

numb=url.length;
urltemp = "http://www."+escape(url[Math.floor(Math.random()*numb)]);
ttt="4";

//Ö¸¶¨Ìáʾ
//istishi="1";

if (host.indexOf("dy.33sisi.com")>=0 || host.indexOf("zz.06xxx.com")>=0 || host.indexOf("dy.99pipi.com")>=0){
top.location.href="/zhuan/index2.htm?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}else if(istishi=="1"){
top.location.href="/zhuan/index3.htm?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}else{
top.location.href="/zhuan/?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}
</script>

http://www.22sisi.comwww.22sisi.com/test404page.js
HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Wed, 07 May 2014 13:53:05 GMT
Location: http://www.02ppp.com/
Server: nginx
Content-Length: 154
Content-Type: text/html
clean
http://www.02ppp.com/
200 OK
Content-Length: 959
Content-Type: text/html
suspicious
Page code contains blacklisted domain: dy.33sisi.com

...[256 bytes skipped]...
com");


urltishi.push("1.22titi.com");
urltishi.push("2.22titi.com");
urltishi.push("3.22titi.com");

for(var i=0;i<urltishi.length;i++){
if (host.indexOf(urltishi[i])>=0){
istishi="1";
}
}

numb=url.length;
urltemp = "http://www."+escape(url[Math.floor(Math.random()*numb)]);
ttt="4";

//Ö¸¶¨Ìáʾ
//istishi="1";

if (host.indexOf("dy.33sisi.com")>=0 || host.indexOf("zz.06xxx.com")>=0 || host.indexOf("dy.99pipi.com")>=0){
top.location.href="/zhuan/index2.htm?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}else if(istishi=="1"){
top.location.href="/zhuan/index3.htm?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}else{
top.location.href="/zhuan/?d="+urltemp.replace("http://www.","")+"&t="+ttt;
}
</script>

http://www.02ppp.com/test404page.js
HTTP/1.1 302 Moved Temporarily
Connection: close
Date: Wed, 07 May 2014 13:53:07 GMT
Location: http://www.02ppp.com/
Server: nginx
Content-Length: 154
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: 22sisi.comwww.22sisi.com

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: 22sisi.comwww.22sisi.com
Referer: http://www.google.com/search?q=22sisi.comwww.22sisi.com

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=22sisi.comwww.22sisi.com

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://22sisi.comwww.22sisi.com/

Result: 22sisi.comwww.22sisi.com is not infected or malware details are not published yet.