Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: 8teenxxx.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 06 Jan 2015 15:27:34 GMT
Pragma: no-cache
Server: Apache/2.2.3 (CentOS)
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=n0v0ta96lg1pjvpd8hadqr6j56; path=/
X-Powered-By: PHP/5.3.3
GET / HTTP/1.1
Host: 8teenxxx.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 06 Jan 2015 15:27:34 GMT
Pragma: no-cache
Server: Apache/2.2.3 (CentOS)
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=n0v0ta96lg1pjvpd8hadqr6j56; path=/
X-Powered-By: PHP/5.3.3
Second query (visit from search engine):
GET / HTTP/1.1
Host: 8teenxxx.com
Referer: http://www.google.com/search?q=8teenxxx.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: 8teenxxx.com
Referer: http://www.google.com/search?q=8teenxxx.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
| Request | Server response | Status |
http://8teenxxx.com/ | 200 OK Content-Length: 176440 Content-Type: text/html | clean |
http://media.8teenxxx.com/js/process.js | 200 OK Content-Length: 7859 Content-Type: application/javascript | clean |
https://ads.exoclick.com/ads.js | 200 OK Content-Length: 774 Content-Type: text/javascript | clean |
http://banners.bookofsex.com/go/page/js_im_box_v2?lang=english&plain_text=1&skip_lpo=1&delay=1&theme=r&dcb=bookofsex.com&find_sex=2&looking_for_person=2&photo=3&explicit=1&no_rating=30&no_flash=1&page=landingx&land=member_video_reg_01?model_id=18&pid=g37510-ppc.sub103x235bookofsex2 | 200 OK Content-Length: 6037 Content-Type: text/html | clean |
http://banners.bookofsex.com/test404page.js | HTTP/1.1 404 Not Found Connection: Keep-Alive Date: Tue, 06 Jan 2015 15:27:39 GMT Location: http://graphics.pop6.com/banners/ffadult/15714_468x80.jpg Server: Apache Content-Length: 0 Content-Type: text/plain Keep-Alive: timeout=5, max=123 Set-Cookie: banner_user_id=78.158.11.226-1420558059-96145; path=/; domain=.bookofsex.com; expires=Wed, 07-Jan-2015 15:27:39 GMT Set-Cookie: banner=ffadult_none_p07_banner-15714_cl0; path=/; domain=.bookofsex.com; expires=Wed, 07-Jan-2015 15:27:39 GMT X-ApacheServer: ki11-65.friendfinderinc.com X-PERF: 0.050550,0.025220,DB_4_0.0078720,CD_10_0.0045150,PK_2_0.0001090,CE_11_0.0128340 | clean |
http://graphics.pop6.com/banners/ffadult/15714_468x80.jpg | 200 OK Content-Length: 51718 Content-Type: image/jpeg | clean |
http://graphics.pop6.com/test404page.js | 404 Not Found Content-Length: 212 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=8teenxxx.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://8teenxxx.com/
Result: 8teenxxx.com is not infected or malware details are not published yet.
Result: 8teenxxx.com is not infected or malware details are not published yet.