Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=info-etudiants.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://info-etudiants.com/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://info-etudiants.com/ | 200 OK Content-Length: 26194 Content-Type: text/html | clean |
http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js | 200 OK Content-Length: 57254 Content-Type: text/javascript | clean |
http://info-etudiants.com/include/javascript/general_functions.php | 200 OK Content-Length: 1074 Content-Type: text/html | clean |
http://info-etudiants.com/test404page.js | 404 Not Found Content-Length: 11725 Content-Type: text/html | clean |
http://www.google.com/jsapi | 200 OK Content-Length: 24552 Content-Type: text/javascript | clean |
http://www.google.com/uds/solutions/slideshow/gfslideshow.js | HTTP/1.1 301 Moved Permanently Cache-Control: public, max-age=2592000 Connection: close Date: Sat, 09 Aug 2014 19:14:41 GMT Age: 22482 Location: http://uds.googleusercontent.com/uds/solutions/slideshow/gfslideshow.js Server: sffe Content-Length: 268 Content-Type: text/html; charset=UTF-8 Expires: Mon, 08 Sep 2014 19:14:41 GMT Alternate-Protocol: 80:quic X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block | clean |
http://uds.googleusercontent.com/uds/solutions/slideshow/gfslideshow.js | 200 OK Content-Length: 35793 Content-Type: application/x-javascript | clean |
http://www.google.com/jsapi?key=ABQIAAAAlbhQBHSOyAs0uaLgY9rW8RTJ0UOYPdqGF7KZ_RmIQgLO8bveZhQaP0__jDDOE9USzgTx7X-gNLfP9w | 200 OK Content-Length: 24627 Content-Type: text/javascript | clean |
http://ads.cpxcenter.com/cpxcenter/showAd.php?nid=4&zone=61055&type=banner&sid=45479&pid=42312&subid= | 200 OK Content-Length: 688 Content-Type: application/x-javascript | malicious |
Malicious code - confirmed by antiviruses (see below) document.write("<img src=\"http://tr4.myroitracking.com/newServing/tracking_id.php?d=ads.cpxcenter.com&r=http%3A%2F%2Fads.cpxcenter.com%2FnewServing%2Ftracking_id.php%3Fb%3D1%26>ruid=1\" width=\"1\" height=\"1\" />"); private_label_prefix = "cpxcenter"; cpxcenter_service = "ads.cpxcenter.com"; cpxcenter_nid = 4; cpxcenter_pid = 42312; cpxcenter_sid = 45479; cpxcenter_zone = 61055; cpxcenter_type = "banner"; if ( typeof(CpxCenter) == "undefined" ) { document.write('<script type="text/javascript" src="http://static.hatid.com/newServing/js/cpxcenter.js"></script>'); } else { CpxCenter.bootstrap(false); } Antivirus reports:
| ||
http://s7.addthis.com/js/250/addthis_widget.js | 200 OK Content-Length: 6948 Content-Type: text/javascript | clean |
http://info-etudiants.com/espace-membre | 200 OK Content-Length: 6444 Content-Type: text/html | clean |
http://info-etudiants.com/include/library/thickbox/thickbox.js | 200 OK Content-Length: 12268 Content-Type: application/javascript | clean |
http://info-etudiants.com/include/library/jquery/ui/ui.core.js | 200 OK Content-Length: 14533 Content-Type: application/javascript | clean |
http://info-etudiants.com/include/library/jquery/ui/ui.tabs.js | 200 OK Content-Length: 19754 Content-Type: application/javascript | clean |
http://info-etudiants.com/include/library/colorbox/jquery.colorbox-min.js | 200 OK Content-Length: 8763 Content-Type: application/javascript | clean |
http://info-etudiants.com/etablissements/ | 200 OK Content-Length: 29991 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: info-etudiants.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Sun, 10 Aug 2014 01:29:21 GMT
Pragma: no-cache
Server: Apache/2.2.22 (Debian)
Vary: Accept-Encoding
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=976uuv0eekrnlacno3epc51kh0; path=/
X-Powered-By: PHP/5.4.4-14+deb7u8
GET / HTTP/1.1
Host: info-etudiants.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Sun, 10 Aug 2014 01:29:21 GMT
Pragma: no-cache
Server: Apache/2.2.22 (Debian)
Vary: Accept-Encoding
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=976uuv0eekrnlacno3epc51kh0; path=/
X-Powered-By: PHP/5.4.4-14+deb7u8
Second query (visit from search engine):
GET / HTTP/1.1
Host: info-etudiants.com
Referer: http://www.google.com/search?q=info-etudiants.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: info-etudiants.com
Referer: http://www.google.com/search?q=info-etudiants.com
Result:
The result is similar to the first query. There are no suspicious redirects found.