Scanned pages/files
Request | Server response | Status |
http://cybrac.com/ | HTTP/1.1 200 OK Connection: close Date: Wed, 04 Jun 2014 20:53:05 GMT Accept-Ranges: bytes ETag: "1470044-4e-4eccebd77b640" Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Content-Length: 78 Content-Type: text/html Last-Modified: Thu, 05 Dec 2013 19:43:13 GMT | clean |
http://cybrac.com/web/index.php | HTTP/1.1 301 Moved Permanently Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection: close Date: Wed, 04 Jun 2014 20:53:05 GMT Pragma: no-cache Location: http://cybrac.com/web/ Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Content-Length: 0 Content-Type: text/html; charset=UTF-8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Set-Cookie: PHPSESSID=8e7bf219688c2beb79cfb41704efc4c9; path=/ X-Pingback: http://cybrac.com/web/xmlrpc.php X-Powered-By: PHP/5.2.17 | clean |
http://cybrac.com/web/ | 200 OK Content-Length: 26149 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if (document.getElementById("form_plugins_url")) { var plugin_url = document.getElementById("form_plugins_url").value; } else { var plugin_url = ""; } Antivirus reports:
| ||
http://cybrac.com/web/wp-includes/js/jquery/jquery.js?ver=1.11.0 | 200 OK Content-Length: 96402 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 | 200 OK Content-Length: 7200 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/uber-grid/assets/js/packery.pkgd.min.js?ver=1.8.3.1 | 200 OK Content-Length: 97002 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/uber-grid/assets/js/jquery.magnific-popup.js?ver=1.8.3.1 | 200 OK Content-Length: 48002 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/uber-grid/assets/js/uber-grid.js?ver=1.8.3.1 | 200 OK Content-Length: 46858 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/anything-popup/anything-popup.js?ver=3.9.1 | 200 OK Content-Length: 6990 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/main_front_end.js?ver=3.9.1 | 200 OK Content-Length: 56963 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/calendar.js?ver=3.9.1 | 200 OK Content-Length: 36556 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/calendar-setup.js?ver=3.9.1 | 200 OK Content-Length: 4919 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/calendar_function.js?ver=3.9.1 | 200 OK Content-Length: 15039 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/jquery-ui.js?ver=3.9.1 | 200 OK Content-Length: 300383 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/form-maker/js/jquery.ui.slider.js?ver=3.9.1 | 200 OK Content-Length: 17595 Content-Type: application/javascript | clean |
http://cybrac.com/web/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20130122 | 200 OK Content-Length: 1015 Content-Type: application/javascript | clean |
http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201423 | 200 OK Content-Length: 9301 Content-Type: application/x-javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: cybrac.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 04 Jun 2014 20:53:05 GMT
Accept-Ranges: bytes
ETag: "1470044-4e-4eccebd77b640"
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Content-Length: 78
Content-Type: text/html
Last-Modified: Thu, 05 Dec 2013 19:43:13 GMT
...78 bytes of data.
GET / HTTP/1.1
Host: cybrac.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 04 Jun 2014 20:53:05 GMT
Accept-Ranges: bytes
ETag: "1470044-4e-4eccebd77b640"
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Content-Length: 78
Content-Type: text/html
Last-Modified: Thu, 05 Dec 2013 19:43:13 GMT
...78 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: cybrac.com
Referer: http://www.google.com/search?q=cybrac.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: cybrac.com
Referer: http://www.google.com/search?q=cybrac.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=cybrac.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://cybrac.com/
Result: cybrac.com is not infected or malware details are not published yet.
Result: cybrac.com is not infected or malware details are not published yet.