Scanned pages/files
Request | Server response | Status |
http://gocheckthis.com/ | 200 OK Content-Length: 696 Content-Type: text/html | clean |
http://gocheckthis.com/.ftpquota | 200 OK Content-Length: 11 Content-Type: text/plain | clean |
http://gocheckthis.com/test404page.js | 500 Internal Server Error Content-Length: 822 Content-Type: text/html | clean |
http://gocheckthis.com/NNC.html | 200 OK Content-Length: 5495 Content-Type: text/html | clean |
http://gocheckthis.com/NNC.php | 200 OK Content-Length: 114 Content-Type: text/html | suspicious |
Deface/Content modification. The following signature was found: HACKED BY BlackX \\\ HACKED BY BlackX \\\' Ops007 We Are No Name Cyber Team Thanks Iqbal Farhan Napi Faizal visit : http://nncteam.info | ||
http://gocheckthis.com/Sculptor3/ | HTTP/1.1 301 Permanantly Connection: close Date: Tue, 10 Feb 2015 02:41:13 GMT Location: http://www.affirmware.com.au Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 Content-Length: 0 Content-Type: text/html X-Powered-By: PHP/5.3.29 | clean |
http://www.affirmware.com.au/ | HTTP/1.1 301 Moved Permanently Connection: close Date: Tue, 10 Feb 2015 02:41:14 GMT Location: http://affirmware.com.au/ Server: Apache mod_fcgid/2.3.7 mod_auth_pgsql/2.0.3 Vary: User-Agent,Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8 X-Pingback: http://affirmware.com.au/xmlrpc.php X-Powered-By: PHP/5.2.17 | clean |
http://affirmware.com.au/ | 200 OK Content-Length: 25412 Content-Type: text/html | clean |
http://affirmware.com.au/wp-content/uploads/jw-player-plugin-for-wordpress/player/jwplayer.js | 200 OK Content-Length: 155682 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/themes/OptimizePress%20NewIfRequired/js/js_cookie.js | 200 OK Content-Length: 613 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-includes/js/jquery/jquery.js | 200 OK Content-Length: 95807 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-includes/js/jquery/jquery-migrate.min.js | 200 OK Content-Length: 7200 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/plugins/wp_optin_pro/sppwebinar.js | 200 OK Content-Length: 5681 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/plugins/google-analyticator/external-tracking.min.js | 200 OK Content-Length: 1190 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/plugins/audio-player/assets/audio-player.js?ver=2.0.4.6 | 200 OK Content-Length: 29366 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/plugins/shortcodedeluxe/jscolor/jscolor.js | 200 OK Content-Length: 25339 Content-Type: application/javascript | clean |
http://affirmware.com.au/wp-content/themes/OptimizePress%20NewIfRequired/js/cufon-yui.js | 200 OK Content-Length: 18258 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: gocheckthis.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 10 Feb 2015 02:41:10 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4
Content-Length: 696
Content-Type: text/html;charset=ISO-8859-1
...696 bytes of data.
GET / HTTP/1.1
Host: gocheckthis.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 10 Feb 2015 02:41:10 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4
Content-Length: 696
Content-Type: text/html;charset=ISO-8859-1
...696 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: gocheckthis.com
Referer: http://www.google.com/search?q=gocheckthis.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: gocheckthis.com
Referer: http://www.google.com/search?q=gocheckthis.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=gocheckthis.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://gocheckthis.com/
Result: gocheckthis.com is not infected or malware details are not published yet.
Result: gocheckthis.com is not infected or malware details are not published yet.