Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: txtbook.com.cn
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Sat, 04 Oct 2014 19:38:23 GMT
Server: Microsoft-IIS/6.0
Content-Length: 99497
Content-Type: text/html; charset=utf-8
Set-Cookie: ASP.NET_SessionId=fmnrr1rntglkf145swusrt45; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
...99497 bytes of data.
GET / HTTP/1.1
Host: txtbook.com.cn
Result:
HTTP/1.1 200 OK
Cache-Control: private
Date: Sat, 04 Oct 2014 19:38:23 GMT
Server: Microsoft-IIS/6.0
Content-Length: 99497
Content-Type: text/html; charset=utf-8
Set-Cookie: ASP.NET_SessionId=fmnrr1rntglkf145swusrt45; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
...99497 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: txtbook.com.cn
Referer: http://www.google.com/search?q=txtbook.com.cn
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: txtbook.com.cn
Referer: http://www.google.com/search?q=txtbook.com.cn
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
| Request | Server response | Status |
http://txtbook.com.cn/ | 200 OK Content-Length: 99497 Content-Type: text/html | clean |
http://cbjs.baidu.com/js/m.js | 200 OK Content-Length: 30288 Content-Type: application/x-javascript | clean |
http://cbjs.baidu.com/js/o.js | 200 OK Content-Length: 30288 Content-Type: application/x-javascript | clean |
http://cpro.baidustatic.com/cpro/ui/c.js | 200 OK Content-Length: 82097 Content-Type: application/x-javascript | clean |
http://book.txtbook.com.cn/pushjs/txtbookggindex2.js | 500 timeout Content-Length: 30 Content-Type: text/plain | clean |
http://book.txtbook.com.cn/test404page.js | 404 Not Found Content-Length: 1308 Content-Type: text/html | clean |
http://book.txtbook.com.cn/pushjs/txtbookggindex18.js | HTTP/1.1 200 OK Date: Sat, 04 Oct 2014 19:28:33 GMT Accept-Ranges: bytes ETag: "f23257617e0cf1:25cae" Server: Microsoft-IIS/6.0 Content-Length: 3370 Content-Location: http://book.txtbook.com.cn/pushjs/txtbookggindex18.js Content-Type: application/x-javascript Last-Modified: Sat, 04 Oct 2014 19:14:11 GMT X-Powered-By: ASP.NET | clean |
http://www.txtbook.com.cn/app/app2.js | 200 OK Content-Length: 1018 Content-Type: application/x-javascript | clean |
http://s94.cnzz.com/stat.php?id=301259&web_id=301259&show=pic | 200 OK Content-Length: 9322 Content-Type: application/javascript | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=txtbook.com.cn
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://txtbook.com.cn/
Result: txtbook.com.cn is not infected or malware details are not published yet.
Result: txtbook.com.cn is not infected or malware details are not published yet.