New scan:

Malware Scanner report for shtetel.com

Malicious/Suspicious/Total urls checked
0/0/5
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/1/2
1 suspicious iframe found. See details below
Deface / Content modification
Found
Probably the website is defaced. The following signature was found:

You Got Hacked By ./Kh4lifax  (60 websites defaced)

See details below

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://shtetel.com/
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Sat, 05 Apr 2014 19:49:16 GMT
Location: http://www.shtetel.com/
Server: Apache
Vary: Accept-Encoding
Content-Length: 231
Content-Type: text/html; charset=iso-8859-1
clean
http://www.shtetel.com/
200 OK
Content-Length: 10769
Content-Type: text/html
suspicious
Hidden iFrame found. The same iFrame was found in 7 websites.
size: 0x0     
src: http://www.youtube.com/embed/cm8ic2twgjk?autoplay=1&loop=1

<iframe width="0" height="0" src="http://www.youtube.com/embed/cm8ic2twgjk?autoplay=1&loop=1" frameborder="0">

Deface/Content modification. The following signature was found: You Got Hacked By ./Kh4lifax

...[1014 bytes skipped]...
"keywords" content="Anonymous #OccupyPhilippines, Anonymous Butuan, PrivateX, #pR.ison3r, busabos, Phantom Hackers.PH"/>
<body oncontextmenu="return false" onkeydown="return false">

<script language="JavaScript">


function tb5_makeArray(n){
this.length = n;
return this.length;
}

tb5_messages = new tb5_makeArray(5);
tb5_messages[0] = "You Got Hacked By ./Kh4lifax";
tb5_messages[1] = "We are Phantoms Hackers.PH";
tb5_messages[2] = "We Love Hacking!";
tb5_messages[3] = "Gray Hat Hacker Here!";
tb5_messages[4] = "Don't Worry";
tb5_messages[5] = "Your DataBase Is Safe";
tb5_messages[6] = "We just want to inform you that your site security is low .";
tb5_messages[7] = "Fixed it as soon possible, or else other hacker will hacked your system !";
tb5_rptType = 'infinite';
tb5_rptNbr = 10; <
...[10617 bytes skipped]...


https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
200 OK
Content-Length: 93435
Content-Type: text/javascript
clean
http://shtetel.com/test404page.js
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Sat, 05 Apr 2014 19:49:18 GMT
Location: http://www.shtetel.com/test404page.js
Server: Apache
Vary: Accept-Encoding
Content-Length: 245
Content-Type: text/html; charset=iso-8859-1
clean
http://www.shtetel.com/test404page.js
404 Not Found
Content-Length: 331
Content-Type: text/html
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: shtetel.com

Result:
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Sat, 05 Apr 2014 19:49:16 GMT
Location: http://www.shtetel.com/
Server: Apache
Vary: Accept-Encoding
Content-Length: 231
Content-Type: text/html; charset=iso-8859-1

...231 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: shtetel.com
Referer: http://www.google.com/search?q=shtetel.com

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=shtetel.com

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://shtetel.com/

Result: shtetel.com is not infected or malware details are not published yet.