Scanned pages/files
Request | Server response | Status |
http://happyhour365.info/ | HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 14 Apr 2014 21:27:11 GMT Location: http://www.happyhour365.com/ Server: Apache Vary: Accept-Encoding Content-Length: 236 Content-Type: text/html; charset=iso-8859-1 | clean |
http://www.happyhour365.com/ | 200 OK Content-Length: 9248 Content-Type: text/html | suspicious |
Malicious code - confirmed by antiviruses (see below) window.scrollBy(0,1) window.resizeTo(0,0) window.moveTo(0,0) setTimeout("move()",1);var mxm=50 var mym=25 var mx=0 var my=0 var sv=50 var status=1 var szx=0 var szy=0 var c=255 var n=0 var sm=30 var cycle=2 var done=2 function move() {if(status==1) {mxm=mxm/1.05 mym=mym/1.05 mx=mx mxm my=my-mym mxm=mxm(400-mx)/100 mym=mym-(300-my)/100 window.moveTo(mx,my) rmxm=Math.round(mxm/10) rmym=Math.roun cycle=cycle-1 if(cycle>0) {if(done==1) {status=7} else {status=4}}}} if(status==6) {document.title="Cljck" alert("Cljck") cycle=2 status=4 done=1} if(status==7) {c=c 4 document.bgColor=c*65536 document.fgColor=(255-c)*65536 if(c>128) {status=8}} if(status==8) {window.moveTo(0,0) sx=screen.availWidth sy=screen.availHeight window.resizeTo(sx,sy) status=9} var timer=setTimeout("move()",0.3)} Antivirus reports:
Deface/Content modification. The following signature was found: Hacked By Faltu Pola <!Copy Rights are only for Faltu Pola "> <HTML><HEAD><META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link REL="SHORTCUT ICON" HREF="http://fc01.deviantart.net/fs40/i/2009/010/0/9/Bangladesh_Grunge_Flag_by_think0.jpg"> <script language="JavaScript">var left="|| Faltu Pola ||";var right="|| Faltu Pola ||";var msg=" Hacked By Faltu Pola ";var speed=200;function scroll_title(){document.title=left msg right;msg=msg.substring(1,msg.length)msg.charAt(0);setTimeout("scroll_title()",speed);} scroll_title();</script> <style type="text/css">.style1{color:red;font-size:x-large;font-weight:bold}</style> </HEAD> <BODY bgcolor="#000000"> <CENTER> <p align="center"> <br><br> <DIV style ...[10311 bytes skipped]... | ||
http://www.happyhour365.com/test404page.js | 200 OK Content-Length: 9262 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) window.scrollBy(0,1) window.resizeTo(0,0) window.moveTo(0,0) setTimeout("move()",1);var mxm=50 var mym=25 var mx=0 var my=0 var sv=50 var status=1 var szx=0 var szy=0 var c=255 var n=0 var sm=30 var cycle=2 var done=2 function move() {if(status==1) {mxm=mxm/1.05 mym=mym/1.05 mx=mx mxm my=my-mym mxm=mxm(400-mx)/100 mym=mym-(300-my)/100 window.moveTo(mx,my) rmxm=Math.round(mxm/10) rmym=Math.roun cycle=cycle-1 if(cycle>0) {if(done==1) {status=7} else {status=4}}}} if(status==6) {document.title="Cljck" alert("Cljck") cycle=2 status=4 done=1} if(status==7) {c=c 4 document.bgColor=c*65536 document.fgColor=(255-c)*65536 if(c>128) {status=8}} if(status==8) {window.moveTo(0,0) sx=screen.availWidth sy=screen.availHeight window.resizeTo(sx,sy) status=9} var timer=setTimeout("move()",0.3)} Antivirus reports:
|
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: happyhour365.info
Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 14 Apr 2014 21:27:11 GMT
Location: http://www.happyhour365.com/
Server: Apache
Vary: Accept-Encoding
Content-Length: 236
Content-Type: text/html; charset=iso-8859-1
...236 bytes of data.
GET / HTTP/1.1
Host: happyhour365.info
Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 14 Apr 2014 21:27:11 GMT
Location: http://www.happyhour365.com/
Server: Apache
Vary: Accept-Encoding
Content-Length: 236
Content-Type: text/html; charset=iso-8859-1
...236 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: happyhour365.info
Referer: http://www.google.com/search?q=happyhour365.info
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: happyhour365.info
Referer: http://www.google.com/search?q=happyhour365.info
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=happyhour365.info
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://happyhour365.info/
Result: happyhour365.info is not infected or malware details are not published yet.
Result: happyhour365.info is not infected or malware details are not published yet.