Scanned pages/files
Request | Server response | Status |
http://columbiatoughmother.com/ | HTTP/1.1 301 Moved Permanently Cache-Control: no-cache,no-store,must-revalidate Connection: close Date: Wed, 30 Jul 2014 05:51:21 GMT Pragma: no-cache Accept-Ranges: bytes Location: http://www.columbia.com Server: Demandware eCommerce Server Vary: Accept-Encoding Content-Length: 1 Content-Type: text/html;charset=UTF-8 Expires: Thu, 01 Dec 1994 16:00:00 GMT Set-Cookie: dwac_bcTzIiaagStlAaaacFPtt5neAG=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM%3D|demandaacwcolumbiaus|||USD|false|US%2FPacific|true; Path=/ Set-Cookie: sid=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM; Path=/ Set-Cookie: dwpersonalization_6148ff3835e27262c32d6dc123dc430d=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: dwanonymous_6148ff3835e27262c32d6dc123dc430d=acbcsJKv0Xa8cvD3eg7lYoxxFz; Expires=Mon, 26-Jan-2015 05:51:21 GMT; Path=/ Set-Cookie: dwsid=pcVqvTA5IG0kK2vPiHFt1mF8m2F5Y3DJVfVn8V5R0qqwDrq7_vaHEs2dhwLJgHgV_C_4u1UmUbS0P20TMqQcuA==; path=/; HttpOnly | clean |
http://www.columbia.com/ | HTTP/1.1 302 Found Cache-Control: no-cache,no-store,must-revalidate Connection: close Date: Wed, 30 Jul 2014 05:51:21 GMT Pragma: no-cache Accept-Ranges: bytes Location: http://www.columbia.com/on/demandware.store/Sites-Columbia_US-Site/default/Home-SelectCountry Server: Demandware eCommerce Server Vary: Accept-Encoding Content-Length: 174042 Content-Type: text/html;charset=UTF-8 Expires: Thu, 01 Dec 1994 16:00:00 GMT Set-Cookie: dwac_bcTzIiaagStlAaaacFPtt5neAG=AUAFVHsZTGe98PwzFY_UjwMePVFvE1wz9v4%3D|demandaacwcolumbiaus|||USD|false|US%2FPacific|true; Path=/ Set-Cookie: sid=AUAFVHsZTGe98PwzFY_UjwMePVFvE1wz9v4; Path=/ Set-Cookie: dwpersonalization_6148ff3835e27262c32d6dc123dc430d=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: dwanonymous_6148ff3835e27262c32d6dc123dc430d=abxCKT5HWu8I3lJrdCwi84X6Ny; Expires=Mon, 26-Jan-2015 05:51:21 GMT; Path=/ Set-Cookie: dwsid=tNajs2pHaEBDkseOAUiSQbaIm7Z-TXgUCJyg6Nx8H0cFHY62KQKHxdFkzGU-jlG1msaZ3HPxt96tnz685VAcbw==; path=/; HttpOnly | clean |
http://www.columbia.com/on/demandware.store/sites-columbia_us-site/default/home-selectcountry | 404 Not Found Content-Length: 400 Content-Type: text/html | clean |
http://www.columbia.com/test404page.js | 410 Gone Content-Length: 128706 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var axel = Math.random() + ""; var a = axel * 10000000000000; document.write('<iframe src="http://fls.doubleclick.net/activityi;src=3831845;type=remar803;cat=c olum353;ord=' + a + '?" width="1" height="1" frameborder="0" style="display:none"></iframe>'); Antivirus reports:
| ||
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery-1.3.1.min.js | 200 OK Content-Length: 55272 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/date.js | 200 OK Content-Length: 12057 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.datePicker.min-2.1.2.js | 200 OK Content-Length: 13254 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.autocomplete.js | 200 OK Content-Length: 14176 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.mousewheel.js | 200 OK Content-Length: 2496 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.em.js | 200 OK Content-Length: 5515 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.jscrollpane.js | 200 OK Content-Length: 17399 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.bgiframe.js | 200 OK Content-Length: 4881 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/jquery.ui.personalized.1.6rc5.min.js | 200 OK Content-Length: 165027 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/lib/swfobject.js | 200 OK Content-Length: 9821 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/lib/js/swfobject_source.js | 200 OK Content-Length: 9321 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/lib/js/jquery.validate.js | 200 OK Content-Length: 35434 Content-Type: text/javascript | clean |
http://demandware.edgesuite.net/aacw_prd/on/demandware.static/Sites-Columbia_US-Site/-/default/v1406697728117/js/rf.js | 200 OK Content-Length: 80701 Content-Type: text/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: columbiatoughmother.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: no-cache,no-store,must-revalidate
Connection: close
Date: Wed, 30 Jul 2014 05:51:21 GMT
Pragma: no-cache
Accept-Ranges: bytes
Location: http://www.columbia.com
Server: Demandware eCommerce Server
Vary: Accept-Encoding
Content-Length: 1
Content-Type: text/html;charset=UTF-8
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: dwac_bcTzIiaagStlAaaacFPtt5neAG=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM%3D|demandaacwcolumbiaus|||USD|false|US%2FPacific|true; Path=/
Set-Cookie: sid=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM; Path=/
Set-Cookie: dwpersonalization_6148ff3835e27262c32d6dc123dc430d=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: dwanonymous_6148ff3835e27262c32d6dc123dc430d=acbcsJKv0Xa8cvD3eg7lYoxxFz; Expires=Mon, 26-Jan-2015 05:51:21 GMT; Path=/
Set-Cookie: dwsid=pcVqvTA5IG0kK2vPiHFt1mF8m2F5Y3DJVfVn8V5R0qqwDrq7_vaHEs2dhwLJgHgV_C_4u1UmUbS0P20TMqQcuA==; path=/; HttpOnly
...1 bytes of data.
GET / HTTP/1.1
Host: columbiatoughmother.com
Result:
HTTP/1.1 301 Moved Permanently
Cache-Control: no-cache,no-store,must-revalidate
Connection: close
Date: Wed, 30 Jul 2014 05:51:21 GMT
Pragma: no-cache
Accept-Ranges: bytes
Location: http://www.columbia.com
Server: Demandware eCommerce Server
Vary: Accept-Encoding
Content-Length: 1
Content-Type: text/html;charset=UTF-8
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Set-Cookie: dwac_bcTzIiaagStlAaaacFPtt5neAG=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM%3D|demandaacwcolumbiaus|||USD|false|US%2FPacific|true; Path=/
Set-Cookie: sid=P0Dq70bPrXbLPclSsVK1nPv5GzMPlf3SuuM; Path=/
Set-Cookie: dwpersonalization_6148ff3835e27262c32d6dc123dc430d=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: dwanonymous_6148ff3835e27262c32d6dc123dc430d=acbcsJKv0Xa8cvD3eg7lYoxxFz; Expires=Mon, 26-Jan-2015 05:51:21 GMT; Path=/
Set-Cookie: dwsid=pcVqvTA5IG0kK2vPiHFt1mF8m2F5Y3DJVfVn8V5R0qqwDrq7_vaHEs2dhwLJgHgV_C_4u1UmUbS0P20TMqQcuA==; path=/; HttpOnly
...1 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: columbiatoughmother.com
Referer: http://www.google.com/search?q=columbiatoughmother.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: columbiatoughmother.com
Referer: http://www.google.com/search?q=columbiatoughmother.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=columbiatoughmother.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://columbiatoughmother.com/
Result: columbiatoughmother.com is not infected or malware details are not published yet.
Result: columbiatoughmother.com is not infected or malware details are not published yet.