Scanned pages/files
| Request | Server response | Status |
http://remunerationtrust.co.uk/ | 200 OK Content-Length: 5656 Content-Type: text/html | suspicious |
Deface/Content modification. The following signature was found: --=[ HACKED BY ZZ404 ]=-- ...[697 bytes skipped]... /><center><img src="http://i.imgur.com/dg6G1xZ.png"></center> <script type="text/javascript" src="https://googledrive.com/host/0B1EwvrStfIUwaDJfaGM1RTc3MU0"></script> <div class="style2" ALIGN="CENTER"><p id="message"><font color="#FFFFFF" style="text-shadow: 0 0 0.2em #00D2FF, 0 0 0.2em #00B8E0, 0 0 0.2em #009DBF, 0 0 0.2em #0086A3;" size="5" face="Papyrus">--=[ HACKED BY ZZ404 ]=--</font><br/><div class="style2" ALIGN="CENTER"><p id="message"><font color="#FFFFFF" style="text-shadow: 0 0 0.2em #00D2FF, 0 0 0.2em #00B8E0, 0 0 0.2em #009DBF, 0 0 0.2em #0086A3;" size="4" face="Papyrus">" we are just a team that need of compactness and solidarity "</font> <script type="text/javascript"> new TypingText(document.getElementById("message"), 170, function(i){ var ar = new Array("_"); return " " + ar[i.l ...[4976 bytes skipped]... | ||
https://googledrive.com/host/0B1EwvrStfIUwaDJfaGM1RTc3MU0 | HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: close Date: Sun, 26 Oct 2014 22:27:29 GMT Pragma: no-cache Location: https://31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com/host/0B1EwvrStfIUwaDJfaGM1RTc3MU0 Server: GSE Content-Type: text/html; charset=UTF-8 Expires: Fri, 01 Jan 1990 00:00:00 GMT Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, GData-Version, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, X-ClientDetails, X-GData-Client, X-GData-Key, X-Goog-AuthUser, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Experiments, x-goog-iam-role, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, X-Goog-Visitor-Id, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Origin, X-Referer, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Origin: * Alternate-Protocol: 443:quic,p=0.01 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block | clean |
https://31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com/host/0b1ewvrstfiuwadjfagm1rtc3mu0 | HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: close Date: Sun, 26 Oct 2014 22:27:30 GMT Pragma: no-cache Location: https://fedc70c70a08da14ccae19671185a97152c1a7c1-31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com/host/0b1ewvrstfiuwadjfagm1rtc3mu0 Server: GSE Content-Type: text/html; charset=UTF-8 Expires: Fri, 01 Jan 1990 00:00:00 GMT Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, GData-Version, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, X-ClientDetails, X-GData-Client, X-GData-Key, X-Goog-AuthUser, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Experiments, x-goog-iam-role, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, X-Goog-Visitor-Id, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Origin, X-Referer, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Origin: * Alternate-Protocol: 443:quic,p=0.01 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block | clean |
https://fedc70c70a08da14ccae19671185a97152c1a7c1-31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com/host/0b1ewvrstfiuwadjfagm1rtc3mu0 | 500 Can't connect to fedc70c70a08da14ccae19671185a97152c1a7c1-31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com:443 Content-Length: 274 Content-Type: text/plain | clean |
http://fedc70c70a08da14ccae19671185a97152c1a7c1-31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com/test404page.js | 500 Can't connect to fedc70c70a08da14ccae19671185a97152c1a7c1-31898c23a743ea80bdcbb5ac918343e1eed44ffc.googledrive.com:80 Content-Length: 272 Content-Type: text/plain | clean |
http://masterendi.googlecode.com/files/salju.js | 403 Forbidden Content-Length: 2151 Content-Type: text/html | clean |
http://masterendi.googlecode.com//www.google.com/ | 404 Not Found Content-Length: 1425 Content-Type: text/html | clean |
http://remunerationtrust.co.uk//www.google.com/ | 200 OK Content-Length: 5656 Content-Type: text/html | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: remunerationtrust.co.uk
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 26 Oct 2014 22:27:29 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html
Ngpass_all: 1
GET / HTTP/1.1
Host: remunerationtrust.co.uk
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sun, 26 Oct 2014 22:27:29 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html
Ngpass_all: 1
Second query (visit from search engine):
GET / HTTP/1.1
Host: remunerationtrust.co.uk
Referer: http://www.google.com/search?q=remunerationtrust.co.uk
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: remunerationtrust.co.uk
Referer: http://www.google.com/search?q=remunerationtrust.co.uk
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=remunerationtrust.co.uk
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://remunerationtrust.co.uk/
Result: remunerationtrust.co.uk is not infected or malware details are not published yet.
Result: remunerationtrust.co.uk is not infected or malware details are not published yet.