Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: bestportalxx.com
Result:
HTTP/1.1 200 OK
Cache-Control: max-age=259200
Connection: close
Date: Mon, 02 Mar 2015 12:25:37 GMT
Pragma: no-cache
Server: nginx/1.0.14
Content-Type: text/html; charset=utf-8
Expires: Thu, 05 Mar 2015 12:25:37 GMT
Set-Cookie: PHPSESSID=7bfben23v0hq4nkog3b4b85g86; path=/
Set-Cookie: s328=1%3A1%3A%3A%3A; expires=Tue, 03-Mar-2015 12:25:37 GMT; path=/
Set-Cookie: ip=78.158.11.226; expires=Tue, 03-Mar-2015 12:25:37 GMT; path=/
X-Powered-By: PHP/5.3.10
GET / HTTP/1.1
Host: bestportalxx.com
Result:
HTTP/1.1 200 OK
Cache-Control: max-age=259200
Connection: close
Date: Mon, 02 Mar 2015 12:25:37 GMT
Pragma: no-cache
Server: nginx/1.0.14
Content-Type: text/html; charset=utf-8
Expires: Thu, 05 Mar 2015 12:25:37 GMT
Set-Cookie: PHPSESSID=7bfben23v0hq4nkog3b4b85g86; path=/
Set-Cookie: s328=1%3A1%3A%3A%3A; expires=Tue, 03-Mar-2015 12:25:37 GMT; path=/
Set-Cookie: ip=78.158.11.226; expires=Tue, 03-Mar-2015 12:25:37 GMT; path=/
X-Powered-By: PHP/5.3.10
Second query (visit from search engine):
GET / HTTP/1.1
Host: bestportalxx.com
Referer: http://www.google.com/search?q=bestportalxx.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: bestportalxx.com
Referer: http://www.google.com/search?q=bestportalxx.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
| Request | Server response | Status |
http://bestportalxx.com/ | 200 OK Content-Length: 8514 Content-Type: text/html | clean |
http://bestportalxx.com/portal/skins/js/jquery-1.7.2.min.js | 200 OK Content-Length: 94840 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/content/js/format_number.js | 200 OK Content-Length: 5947 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/?page=control | 200 OK Content-Length: 8904 Content-Type: text/html | clean |
http://bestportalxx.com/portal/skins/js/jquery-ui-1.8.23.custom.min.js | 200 OK Content-Length: 61960 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/portal/rules.php | 200 OK Content-Length: 30815 Content-Type: text/html | clean |
http://bestportalxx.com/test404page.js | 404 Not Found Content-Length: 571 Content-Type: text/html | clean |
http://bestportalxx.com/?page=activate | 200 OK Content-Length: 7324 Content-Type: text/html | clean |
http://bestportalxx.com/?page=mail | 200 OK Content-Length: 2131 Content-Type: text/html | clean |
http://bestportalxx.com/thrones/ | 200 OK Content-Length: 8674 Content-Type: text/html | clean |
http://bestportalxx.com/thrones/skins/default/js/jquery-1.7.2.min.js | 200 OK Content-Length: 94840 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/thrones/skins/default/js/jquery-ui-1.8.23.custom.min.js | 200 OK Content-Length: 61960 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/thrones/skins/default/js/jquery.cookie.js | 200 OK Content-Length: 1941 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/thrones/skins/default/js/scripts.js | 200 OK Content-Length: 2173 Content-Type: application/x-javascript | clean |
http://bestportalxx.com/thrones/?page=join&action=activate&join=1 | 200 OK Content-Length: 9518 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=bestportalxx.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://bestportalxx.com/
Result: bestportalxx.com is not infected or malware details are not published yet.
Result: bestportalxx.com is not infected or malware details are not published yet.