New scan:

Malware Scanner report for faso.us

Malicious/Suspicious/Total urls checked
1/0/19
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://faso.us/
HTTP/1.1 404 Not Found
Cache-Control: private
Connection: close
Date: Wed, 03 Sep 2014 22:03:26 GMT
Location: http://fineartstudioonline.com
Server: Microsoft-IIS/7.5
Content-Length: 18
Content-Type: text/html
X-Powered-By: ASP.NET
clean
http://fineartstudioonline.com/
HTTP/1.1 301 Moved Permanently
Cache-Control: private
Date: Wed, 03 Sep 2014 22:03:30 GMT
Location: http://faso.com/
Server: Microsoft-IIS/6.0
Content-Length: 0
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCCBSTCCD=NGBIBCMDJHMKILLCDIILGJPN; path=/
X-Powered-By: ASP.NET
clean
http://faso.com/
200 OK
Content-Length: 30649
Content-Type: text/html
clean
http://faso.com/static/js/showhide.js
200 OK
Content-Length: 3170
Content-Type: application/x-javascript
clean
http://faso.us//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js/
HTTP/1.1 301 Moved Permanently
Cache-Control: private
Date: Wed, 03 Sep 2014 22:03:23 GMT
Location: http://links.fineartstudioonline.com/links/1.49838729633054E+88
Server: Microsoft-IIS/6.0
Content-Length: 292
Content-Type: text/html
Set-Cookie: ASPSESSIONIDACRARQCT=EDMMIPHDFIKLBOFKPIIAHKAL; path=/
X-Powered-By: ASP.NET
clean
http://links.fineartstudioonline.com/links/1.49838729633054e+88
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Wed, 03 Sep 2014 22:03:26 GMT
Location: http://faso.com/brushbuzz/links/1.49838729633054e+88
Server: Microsoft-IIS/6.0
Content-Length: 17543
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.5
clean
http://faso.com/brushbuzz/links/1.49838729633054e+88
200 OK
Content-Length: 0
Content-Type: text/html
clean
http://faso.com/test404page.js
404 Not Found
Content-Length: 12068
Content-Type: text/html
clean
http://faso.com//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js/
404 Not Found
Content-Length: 12068
Content-Type: text/html
clean
http://faso.com.edgesuite.net/static/js/jquery.cookie.js
200 OK
Content-Length: 4341
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/easySlider1.7.js
200 OK
Content-Length: 7060
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/signup.js
200 OK
Content-Length: 1739
Content-Type: application/x-javascript
clean
http://faso.com/static/js/tipsy.js
200 OK
Content-Length: 10043
Content-Type: application/x-javascript
clean
https://static.getclicky.com/js
200 OK
Content-Length: 17505
Content-Type: application/x-javascript
clean
http://data.fineartstudioonline.com/admin/analytics/analytics.js
200 OK
Content-Length: 1366
Content-Type: application/x-javascript
malicious
Malicious code - confirmed by antiviruses (see below)

function qsrequest( name )
{
name = name.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");
var regexS = "[\\?&]"+name+"=([^&#]*)";
var regex = new RegExp( regexS );
var results = regex.exec( window.location.href );
if( results == null )
return "";
else
return results[1];
}

var promo=encodeURIComponent(qsrequest('promo'));
var url=encodeURIComponent(document.location.href);
var title=encodeURIComponent
... 379 bytes are skipped ...
r/>


if(window.location.hash) {
var hash = window.location.hash.substring(1); var str_fcid = hash;
var ary_fcid = str_fcid.split('fcid=');
fcid = ary_fcid[1];
}



document.write('<iframe src="http://data.fineartstudioonline.com/admin/analytics/?ref=' + refurl + '&url=' + url +'&promo=' + promo + '&gclid=' + gclid + '&fcid=' + fcid + '" width="0px" height="0px"></iframe>');

Antivirus reports:

nProtect
Trojan.Iframe.ACG
TrendMicro-HouseCall
Mal_Hifrm
Emsisoft
Trojan.Iframe.ACG (B)
TrendMicro
Mal_Hifrm
MicroWorld-eScan
Trojan.Iframe.ACG
F-Secure
Trojan.Iframe.ACG
VIPRE
Malware.JS.Generic (JS)
GData
Trojan.Iframe.ACG
BitDefender
Trojan.Iframe.ACG

http://data.fineartstudioonline.com/styles/default/fasostatsexternal.js
200 OK
Content-Length: 4733
Content-Type: application/x-javascript
clean
http://faso.com.edgesuite.net/static/js/bd.js
200 OK
Content-Length: 229
Content-Type: application/x-javascript
clean
http://faso.com/blog
200 OK
Content-Length: 32241
Content-Type: text/html
clean
http://faso.com/static/js/jquery.js
200 OK
Content-Length: 54267
Content-Type: application/x-javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: faso.us

Result:
HTTP/1.1 404 Not Found
Cache-Control: private
Connection: close
Date: Wed, 03 Sep 2014 22:03:26 GMT
Location: http://fineartstudioonline.com
Server: Microsoft-IIS/7.5
Content-Length: 18
Content-Type: text/html
X-Powered-By: ASP.NET

...18 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: faso.us
Referer: http://www.google.com/search?q=faso.us

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=faso.us

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://faso.us/

Result: faso.us is not infected or malware details are not published yet.