Scanned pages/files
Request | Server response | Status |
http://aulaideal.com/ | HTTP/1.1 301 Moved Permanently Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection: close Date: Fri, 22 Aug 2014 10:04:19 GMT Pragma: no-cache Location: http://www.aulaideal.com/ Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Content-Length: 0 Content-Type: text/html; charset=UTF-8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/ Set-Cookie: PHPSESSID=5e4a8c19eea4ebae346d3df15f0ef00d; path=/ X-Pingback: http://www.aulaideal.com/xmlrpc.php X-Powered-By: PHP/5.3.28 | clean |
http://www.aulaideal.com/ | 200 OK Content-Length: 15395 Content-Type: text/html | clean |
http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js?ver=1.3.2 | 200 OK Content-Length: 57254 Content-Type: text/javascript | clean |
http://www.aulaideal.com/wp-includes/js/jquery/jquery.js?ver=1.10.2 | 200 OK Content-Length: 93085 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 | 200 OK Content-Length: 7200 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/wordpress-countdown-widget/js/jquery.countdown.min.js?ver=1.0 | 200 OK Content-Length: 12616 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/wordpress-countdown-widget/js/jquery.countdown-es.js?ver=1.0 | 200 OK Content-Length: 555 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/page-expiration-robot-pro/js/swfobject.js?ver=3.8.1 | 200 OK Content-Length: 6911 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/themes/OptimizePress/js/js_cookie.js?ver=1.0 | 200 OK Content-Length: 613 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/s-simple-accordion/s-simple-accordion.js?ver=0.1 | 200 OK Content-Length: 1564 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) $(document).ready(function() { $('.accordionButton').click(function() { $('.accordionButton').removeClass('on'); $('.accordionContent').slideUp('normal'); if($(this).next().is(':hidden') == true) { $(this).addClass('on'); $(this).next().slideDown('normal'); } }); $('.accordionContent').hide(); $('#open').show(); }); Antivirus reports:
| ||
http://apis.google.com/js/plusone.js | 200 OK Content-Length: 12387 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/page-expiration-robot-pro/js/jquery.lwtCountdown-1.0.js?ver=1.4.4 | 200 OK Content-Length: 5249 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/plugins/page-expiration-robot-pro/js/swfobject.js?ver=1.4.4 | 200 OK Content-Length: 6911 Content-Type: application/javascript | clean |
http://aulaideal.com/test404page.js | HTTP/1.1 301 Moved Permanently Cache-Control: no-cache, must-revalidate, max-age=0 Connection: close Date: Fri, 22 Aug 2014 10:04:32 GMT Pragma: no-cache Location: http://www.aulaideal.com/test404page.js Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Content-Length: 0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/ Set-Cookie: PHPSESSID=afdb8dec9a867874ff8b456b636005c0; path=/ X-Pingback: http://www.aulaideal.com/xmlrpc.php X-Powered-By: PHP/5.3.28 | clean |
http://www.aulaideal.com/test404page.js | 404 Not Found Content-Length: 11677 Content-Type: text/html | clean |
http://www.aulaideal.com/wp-content/themes/OptimizePress/js/cufon-yui.js | 200 OK Content-Length: 18258 Content-Type: application/javascript | clean |
http://www.aulaideal.com/wp-content/themes/OptimizePress/js/qtobject.js | 200 OK Content-Length: 2354 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: aulaideal.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Fri, 22 Aug 2014 10:04:19 GMT
Pragma: no-cache
Location: http://www.aulaideal.com/
Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/
Set-Cookie: PHPSESSID=5e4a8c19eea4ebae346d3df15f0ef00d; path=/
X-Pingback: http://www.aulaideal.com/xmlrpc.php
X-Powered-By: PHP/5.3.28
...0 bytes of data.
GET / HTTP/1.1
Host: aulaideal.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Fri, 22 Aug 2014 10:04:19 GMT
Pragma: no-cache
Location: http://www.aulaideal.com/
Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/
Set-Cookie: PHPSESSID=5e4a8c19eea4ebae346d3df15f0ef00d; path=/
X-Pingback: http://www.aulaideal.com/xmlrpc.php
X-Powered-By: PHP/5.3.28
...0 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: aulaideal.com
Referer: http://www.google.com/search?q=aulaideal.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: aulaideal.com
Referer: http://www.google.com/search?q=aulaideal.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=aulaideal.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://aulaideal.com/
Result: aulaideal.com is not infected or malware details are not published yet.
Result: aulaideal.com is not infected or malware details are not published yet.