Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=sms.159.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://sms.159.com/
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Yandex as suspicious. - visiting this web site may harm your computer.
Details are available here.
Scanned pages/files
Request | Server response | Status |
http://sms.159.com/ | 200 OK Content-Length: 14161 Content-Type: text/html | suspicious |
Page code contains blacklisted domain: game.159.com ...[2894 bytes skipped]... ost' action='http://sms.159.com/login.aspx?sms=xin' id='admin' onSubmit='return Check()'> <div class='top'> <div class='top1'><a href='http://sms.159.com' target='_blank' title='æºå®¢åå¡çä¿¡å¹³å°'><img src='/img/top1.gif' /></a></div> <div class='top2'> <div class='top2_1 wxh_hei'> <a href='http://game.159.com' target='_blank' title='ææºæ¸¸æ'>ææºæ¸¸æ</a> <a href='http://desk.159.com' target='_blank' title='ææºå£çº¸'>ææºå£çº¸</a> <a href='http://ring.159.com' target='_blank' title='ææºé声'></a> <a href='http://soft.159.com' target='_blank' title='ææºè½¯ä»¶'>ææºè½¯ä»¶</a> <a href='http ...[13102 bytes skipped]... | ||
http://sms.159.com/base/js/base.js | 200 OK Content-Length: 5506 Content-Type: application/x-javascript | clean |
http://sms.159.com/base/js/common.js | 200 OK Content-Length: 10693 Content-Type: application/x-javascript | clean |
http://sms.159.com/base/js/form.js | 200 OK Content-Length: 12747 Content-Type: application/x-javascript | clean |
http://sms.159.com/base/js/blockui.js | 200 OK Content-Length: 12516 Content-Type: application/x-javascript | clean |
http://sms.159.com/page/system/inc/jquery.js | 200 OK Content-Length: 61978 Content-Type: application/x-javascript | clean |
http://sms.159.com/page/system/inc/jquery.kc.js | 200 OK Content-Length: 8887 Content-Type: application/x-javascript | clean |
http://sms.159.com/-1 | 404 Not Found Content-Length: 1308 Content-Type: text/html | clean |
http://sms.159.com/test404page.js | 404 Not Found Content-Length: 1308 Content-Type: text/html | clean |
http://sms.159.com/Reg.aspx | 200 OK Content-Length: 10207 Content-Type: text/html | suspicious |
Page code contains blacklisted domain: game.159.com ...[3559 bytes skipped]... orm name='admin' method='post' action='/login.aspx?sms=xin' id='admin' onSubmit='return Check()'> <div class='top'> <div class='top1'><a href='http://sms.159.com' target='_blank' title='»ú¿ÍÉÌÎñ¶ÌÐÅƽ̨'><img src='/img/top1.gif' /></a></div> <div class='top2'> <div class='top2_1 wxh_hei'> <a href='http://game.159.com' target='_blank' title='ÊÖ»úÓÎÏ·'>ÊÖ»úÓÎÏ·</a> <a href='http://desk.159.com' target='_blank' title='ÊÖ»ú±ÚÖ½'>ÊÖ»ú±ÚÖ½</a> <a href='http://ring.159.com' target='_blank' title='ÊÖ»úÁåÉù'>ÊÖ»úÁåÉù</a> <a href='http://soft.159.com' target='_blank' title='ÊÖ»úÈí¼þ'>ÊÖ»úÈí¼þ</a> <a href='http://www.uujoy.com' ta ...[7817 bytes skipped]... | ||
http://sms.159.com/index.html | 200 OK Content-Length: 40112 Content-Type: text/html | suspicious |
Page code contains blacklisted domain: game.159.com ...[2894 bytes skipped]... ost' action='http://sms.159.com/login.aspx?sms=xin' id='admin' onSubmit='return Check()'> <div class='top'> <div class='top1'><a href='http://sms.159.com' target='_blank' title='æºå®¢åå¡çä¿¡å¹³å°'><img src='/img/top1.gif' /></a></div> <div class='top2'> <div class='top2_1 wxh_hei'> <a href='http://game.159.com' target='_blank' title='ææºæ¸¸æ'>ææºæ¸¸æ</a> <a href='http://desk.159.com' target='_blank' title='ææºå£çº¸'>ææºå£çº¸</a> <a href='http://ring.159.com' target='_blank' title='ææºé声'></a> <a href='http://soft.159.com' target='_blank' title='ææºè½¯ä»¶'>ææºè½¯ä»¶</a> <a href='http ...[44494 bytes skipped]... | ||
http://sms.159.com/kefu/kefu.js | 200 OK Content-Length: 706 Content-Type: application/x-javascript | clean |
http://code.54kefu.net/kefu/js/49/328049.js | 200 OK Content-Length: 533 Content-Type: application/x-javascript | clean |
http://sms.159.com/js/count.js | 200 OK Content-Length: 474 Content-Type: application/x-javascript | malicious |
Malicious code - confirmed by antiviruses (see below) var _bdhmProtocol = (("https:" == document.location.protocol) ? " https://" : " http://");
document.write(unescape("%3Cscript src='" + _bdhmProtocol + "hm.baidu.com/h.js%3F2beb3264352a23a96640a687d9496910' type='text/javascript'%3E%3C/script%3E")); document.write("<div style='display:none;'>"); document.write("<script src=' http://s137.cnzz.com/stat.php?id=1382900&web_id=1382900' language='JavaScript' charset='gb2312'></script>"); document.write("</div>"); Antivirus reports:
| ||
http://sms.159.com/page/html/cp.html | 200 OK Content-Length: 17105 Content-Type: text/html | suspicious |
Page code contains blacklisted domain: game.159.com ...[2590 bytes skipped]... orm name='admin' method='post' action='/login.aspx?sms=xin' id='admin' onSubmit='return Check()'> <div class='top'> <div class='top1'><a href='http://sms.159.com' target='_blank' title='æºå®¢åå¡çä¿¡å¹³å°'><img src='/img/top1.gif' /></a></div> <div class='top2'> <div class='top2_1 wxh_hei'> <a href='http://game.159.com' target='_blank' title='ææºæ¸¸æ'>ææºæ¸¸æ</a> <a href='http://desk.159.com' target='_blank' title='ææºå£çº¸'>ææºå£çº¸</a> <a href='http://ring.159.com' target='_blank' title='ææºé声'>ææºé声</a> <a href='http://soft.159.com' target='_blank' title='ææºè½¯ä»¶'>ææºè½¯ä»¶</a> < ...[17048 bytes skipped]... |
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: sms.159.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Apr 2014 09:29:59 GMT
Accept-Ranges: bytes
ETag: "ca909692604cf1:d726"
Server: Microsoft-IIS/6.0
Content-Length: 40112
Content-Location: http://sms.159.com/index.html
Content-Type: text/html
Last-Modified: Sun, 29 Dec 2013 06:38:23 GMT
X-Died: timeout at scan.pm line 1538.
X-Powered-By: ASP.NET
...40112 bytes of data.
GET / HTTP/1.1
Host: sms.159.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Apr 2014 09:29:59 GMT
Accept-Ranges: bytes
ETag: "ca909692604cf1:d726"
Server: Microsoft-IIS/6.0
Content-Length: 40112
Content-Location: http://sms.159.com/index.html
Content-Type: text/html
Last-Modified: Sun, 29 Dec 2013 06:38:23 GMT
X-Died: timeout at scan.pm line 1538.
X-Powered-By: ASP.NET
...40112 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: sms.159.com
Referer: http://www.google.com/search?q=sms.159.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: sms.159.com
Referer: http://www.google.com/search?q=sms.159.com
Result:
The result is similar to the first query. There are no suspicious redirects found.