Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: arwlaw.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: max-age=900
Connection: close
Date: Thu, 05 Mar 2015 07:02:10 GMT
Age: 1
Location: http://www.askmysite.com
Server: Microsoft-IIS/7.5
Content-Length: 0
Content-Type: text/html
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
...0 bytes of data.
GET / HTTP/1.1
Host: arwlaw.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: max-age=900
Connection: close
Date: Thu, 05 Mar 2015 07:02:10 GMT
Age: 1
Location: http://www.askmysite.com
Server: Microsoft-IIS/7.5
Content-Length: 0
Content-Type: text/html
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
...0 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: arwlaw.com
Referer: http://www.google.com/search?q=arwlaw.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: arwlaw.com
Referer: http://www.google.com/search?q=arwlaw.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
Request | Server response | Status |
http://arwlaw.com/ | HTTP/1.1 301 Moved Permanently Cache-Control: max-age=900 Connection: close Date: Thu, 05 Mar 2015 07:02:10 GMT Age: 1 Location: http://www.askmysite.com Server: Microsoft-IIS/7.5 Content-Length: 0 Content-Type: text/html X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET | clean |
http://www.askmysite.com/ | HTTP/1.1 200 OK Date: Thu, 05 Mar 2015 07:02:11 GMT Accept-Ranges: bytes ETag: "27cc1884fc35d01:9453c" Server: Microsoft-IIS/6.0 Content-Length: 29454 Content-Location: http://www.askmysite.com/index.htm Content-Type: text/html Last-Modified: Thu, 22 Jan 2015 04:33:05 GMT MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET | clean |
http://www.askmysite.com/index.htm | 200 OK Content-Length: 29454 Content-Type: text/html | clean |
http://www.namedrive.com/affiliates/Tracking?id=9_e&ref=2gd4a1 | 200 OK Content-Length: 248 Content-Type: text/plain | clean |
http://www.namedrive.com/affiliates/Tracking?id=9_e&ref=2gd4a1&m | HTTP/1.1 302 Found Connection: close Date: Thu, 05 Mar 2015 07:01:47 GMT Location: http://www.namedrive.com?ref=2gd4a1 Server: Apache Vary: Accept-Encoding Content-Length: 0 Content-Type: text/plain; charset=utf-8; | clean |
http://www.namedrive.com?ref=2gd4a1/ | 200 OK Content-Length: 62654 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.js | 200 OK Content-Length: 66370 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/interface.js | 200 OK Content-Length: 67151 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/ndx/searchtab.js | 200 OK Content-Length: 68135 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/ndx/searchfunc.js | 200 OK Content-Length: 68401 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/ui/ui.core.js | 200 OK Content-Length: 67485 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/ui/ui.tabs.js | 200 OK Content-Length: 67334 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.bgiframe.js | 200 OK Content-Length: 68246 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.delegate.js | 200 OK Content-Length: 68097 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.dimensions.js | 200 OK Content-Length: 68393 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.tooltip.js | 200 OK Content-Length: 67926 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.floater.js | 200 OK Content-Length: 67855 Content-Type: text/html | clean |
http://www.namedrive.com?ref=2gd4a1/_static/js/jquery.dropdown.js | 200 OK Content-Length: 68106 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=arwlaw.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://arwlaw.com/
Result: arwlaw.com is not infected or malware details are not published yet.
Result: arwlaw.com is not infected or malware details are not published yet.