Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=pornsextube.de
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://pornsextube.de/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://pornsextube.de/ | HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 15 Sep 2014 11:54:29 GMT Location: http://www.pornsextube.de/ Server: nginx/1.7.1 Content-Length: 184 Content-Type: text/html | clean |
http://www.pornsextube.de/ | 200 OK Content-Length: 18230 Content-Type: text/html | suspicious |
Page code contains blacklisted domain: www.sexpornotube.nl ...[693 bytes skipped]... e13fc32e2839128" /><meta name="robots" content="index, follow" /><meta name="revisit-after" content="1 days" /><link rel="meta" href="/labels.rdf" type="application/rdf+xml" title="ICRA labels" /><meta http-equiv="pics-Label" content='(pics-1.1 "http://www.icra.org/pics/vocabularyv03/" l gen true for "http://SexPornoTube.NL.com" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3) gen true for "http://www.sexpornotube.nl.com" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3))' /><meta name="RATING" content="RTA-5042-1996-1400-1577-RTA" /><link rel="canonical" href="http://www.pornsextube.de/" /><link rel='stylesheet' type='text/css' href='/css/all.css' media='screen' /><script type="text/javascript" src="/js/jquery-1.7.1.min.js"></script><script type="text/javascript" src="/js/main.min.js"></script><meta name='yandex-verification' co ...[2592 bytes skipped]... | ||
http://mobile.plugrush.com/pornsextube.de/3fsb/3fsb.js | 200 OK Content-Length: 0 Content-Type: text/html | clean |
http://mobile.plugrush.com/test404page.js | 200 OK Content-Length: 0 Content-Type: text/html | clean |
http://pornsextube.de/js/jquery-1.7.1.min.js | HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 15 Sep 2014 11:54:30 GMT Location: http://www.pornsextube.de/js/jquery-1.7.1.min.js Server: nginx/1.7.1 Content-Length: 184 Content-Type: text/html | clean |
http://www.pornsextube.de/js/jquery-1.7.1.min.js | 200 OK Content-Length: 93873 Content-Type: application/javascript | clean |
http://pornsextube.de/js/main.min.js | HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 15 Sep 2014 11:54:31 GMT Location: http://www.pornsextube.de/js/main.min.js Server: nginx/1.7.1 Content-Length: 184 Content-Type: text/html | clean |
http://www.pornsextube.de/js/main.min.js | 200 OK Content-Length: 11470 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) var swfobject=function(){var b="undefined",Q="object",n="Shockwave Flash",p="ShockwaveFlash.ShockwaveFlash",P="application/x-shockwave-flash",m="SWFObjectExprInst",j=window,K=document,T=navigator,o=[],N=[],i=[],d=[],J,Z=null,M=null,l=null,e=false,A=false;var h=function(){var v=typeof K.getElementById!=b&&typeof K.getElementsByTagName!=b&&typeof K.createElement!=b,AC=[0,0,0],x=null;if(typeof T.plugins!=b&&typeof T.plugins[n]==Q){x=T.plugins[n].description;if(x&&!(t Antivirus reports:
| ||
http://adspaces.ero-advertising.com/adspace/246592.js | 200 OK Content-Length: 1838 Content-Type: application/javascript | clean |
http://pornsextube.de/js/jquery.lazyload-ad-1.4.2-min.js | HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 15 Sep 2014 11:54:31 GMT Location: http://www.pornsextube.de/js/jquery.lazyload-ad-1.4.2-min.js Server: nginx/1.7.1 Content-Length: 184 Content-Type: text/html | clean |
http://www.pornsextube.de/js/jquery.lazyload-ad-1.4.2-min.js | 200 OK Content-Length: 8566 Content-Type: application/javascript | clean |
http://adspaces.ero-advertising.com/adspace/256454.js | 200 OK Content-Length: 758 Content-Type: application/javascript | clean |
http://adspaces.ero-advertising.com/adspace/258477.js | 200 OK Content-Length: 3985 Content-Type: application/javascript | clean |
http://adspaces.ero-advertising.com/adspace/258516.js | 200 OK Content-Length: 282 Content-Type: application/javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: pornsextube.de
Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 15 Sep 2014 11:54:29 GMT
Location: http://www.pornsextube.de/
Server: nginx/1.7.1
Content-Length: 184
Content-Type: text/html
...184 bytes of data.
GET / HTTP/1.1
Host: pornsextube.de
Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Mon, 15 Sep 2014 11:54:29 GMT
Location: http://www.pornsextube.de/
Server: nginx/1.7.1
Content-Length: 184
Content-Type: text/html
...184 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: pornsextube.de
Referer: http://www.google.com/search?q=pornsextube.de
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: pornsextube.de
Referer: http://www.google.com/search?q=pornsextube.de
Result:
The result is similar to the first query. There are no suspicious redirects found.