Scanned pages/files
| Request | Server response | Status |
http://limoodownload.rzb.ir/ | 200 OK Content-Length: 103065 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) document.write ('<center><iframe width="120" height="240" src="http://ads.rzb.ir/image.php?size_id=7" border="0" scrolling="no" frameborder="0" marginheight="0" marginwidth="0" vspace="0" hspace="0"></iframe>'); Decoded script: <iframe width="0" name="mailform" height="0" style="display:none;" border="0"></iframe> Antivirus reports:
| ||
http://limoodownload.rzb.ir/js/site.js | 200 OK Content-Length: 14814 Content-Type: application/javascript | clean |
http://limoodownload.rzb.ir/code/popup | 200 OK Content-Length: 2522 Content-Type: text/html | clean |
http://limoodownload.rzb.ir/test404page.js | 404 Not Found Content-Length: 9807 Content-Type: text/html | clean |
http://lord-iran.persiangig.com/data/3/popup/online-shop/online-shop.jpg | 200 OK Content-Length: 3110 Content-Type: image/jpeg | clean |
http://www.shop.bia2fun.com/partner/show_ads.php?ads_type=popup&ref=875&page_source=main&show_once=1 | 200 OK Content-Length: 2296 Content-Type: text/html | clean |
http://facepopup.com/popup.php?u=1015358 | HTTP/1.1 301 Moved Permanently Connection: close Date: Thu, 08 May 2014 20:02:06 GMT Location: http://facenama.com/popup.php?u=1015358 Server: LiteSpeed Content-Length: 464 Content-Type: text/html | clean |
http://facenama.com/popup.php?u=1015358 | 200 OK Content-Length: 2134 Content-Type: text/javascript | clean |
http://www.yasfun.com/wp-content/themes/melifun/tab/tinybox.js | 200 OK Content-Length: 4739 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: limoodownload.rzb.ir
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Thu, 08 May 2014 20:01:58 GMT
Pragma: no-cache
Server: LiteSpeed
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=8acf0a6fc4a963204b6b5ffd79a70365; path=/
Set-Cookie: ban_ip=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT
X-Powered-By: PHP/5.3.27
GET / HTTP/1.1
Host: limoodownload.rzb.ir
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Thu, 08 May 2014 20:01:58 GMT
Pragma: no-cache
Server: LiteSpeed
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: PHPSESSID=8acf0a6fc4a963204b6b5ffd79a70365; path=/
Set-Cookie: ban_ip=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT
X-Powered-By: PHP/5.3.27
Second query (visit from search engine):
GET / HTTP/1.1
Host: limoodownload.rzb.ir
Referer: http://www.google.com/search?q=limoodownload.rzb.ir
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: limoodownload.rzb.ir
Referer: http://www.google.com/search?q=limoodownload.rzb.ir
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=limoodownload.rzb.ir
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://limoodownload.rzb.ir/
Result: limoodownload.rzb.ir is not infected or malware details are not published yet.
Result: limoodownload.rzb.ir is not infected or malware details are not published yet.