Scanned pages/files
Request | Server response | Status |
http://agenciaconteudo.net.br/ | 200 OK Content-Length: 32650 Content-Type: text/html | clean |
http://agenciaconteudo.net.br/jquery.fancybox/jquery.fancybox-1.2.1.js | 200 OK Content-Length: 15119 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) ;(function($) { $.fn.fixPNG = function() { return this.each(function () { var image = $(this).css('backgroundImage'); if (image.match(/^url\(["']?(.*\.png)["']?\)$/i)) { image = RegExp.$1; $(this).css({ 'backgroundImage': 'none', 'filter': "progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=" + ($(this).css('backgroundRepeat') == 'no-repeat' ? 'crop' : 'scale') + ", src='" + image + "')" }).each(functio easingIn : 'swing', easingOut : 'swing', easingChange : 'swing', frameWidth : 425, frameHeight : 355, overlayShow : true, overlayOpacity : 0.3, hideOnContentClick : true, centerOnScroll : true, itemArray : [], callbackOnStart : null, callbackOnShow : null, callbackOnClose : null }; $(document).ready(function() { $.fn.fancybox.build(); }); })(jQuery); Antivirus reports:
| ||
http://agenciaconteudo.net.br/jquery.fancybox/jquery.easing.1.3.js | 200 OK Content-Length: 8097 Content-Type: application/javascript | clean |
http://code.jquery.com/jquery-1.7.1.min.js | 200 OK Content-Length: 93868 Content-Type: application/x-javascript | clean |
http://agenciaconteudo.net.br/js/bjqs-1.3.min.js | 200 OK Content-Length: 6976 Content-Type: application/javascript | clean |
https://apis.google.com/js/plusone.js | 200 OK Content-Length: 12791 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/font.js | 200 OK Content-Length: 167 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/jquery-1.4.2.js | 200 OK Content-Length: 72173 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/mopTip/mopTip-2.2.js | 200 OK Content-Length: 8720 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/jquery.pngFix-1.2.js | 200 OK Content-Length: 4668 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/copy.js | 200 OK Content-Length: 116 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/empresa.html | 200 OK Content-Length: 22723 Content-Type: text/html | clean |
http://agenciaconteudo.net.br/js/jquery.js | 200 OK Content-Length: 93867 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/functions.js | 200 OK Content-Length: 1438 Content-Type: application/javascript | clean |
http://agenciaconteudo.net.br/js/DD_belatedPNG_0.0.7a.js | 200 OK Content-Length: 10556 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: agenciaconteudo.net.br
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 03 Mar 2015 20:53:16 GMT
Accept-Ranges: bytes
Server: Apache
Content-Length: 32650
Content-Type: text/html
Last-Modified: Thu, 22 May 2014 19:26:32 GMT
...32650 bytes of data.
GET / HTTP/1.1
Host: agenciaconteudo.net.br
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 03 Mar 2015 20:53:16 GMT
Accept-Ranges: bytes
Server: Apache
Content-Length: 32650
Content-Type: text/html
Last-Modified: Thu, 22 May 2014 19:26:32 GMT
...32650 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: agenciaconteudo.net.br
Referer: http://www.google.com/search?q=agenciaconteudo.net.br
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: agenciaconteudo.net.br
Referer: http://www.google.com/search?q=agenciaconteudo.net.br
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=agenciaconteudo.net.br
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://agenciaconteudo.net.br/
Result: agenciaconteudo.net.br is not infected or malware details are not published yet.
Result: agenciaconteudo.net.br is not infected or malware details are not published yet.