Scanned pages/files
| Request | Server response | Status |
http://webgame.jyc.la/ | 200 OK Content-Length: 30859 Content-Type: text/html | clean |
http://union.163.com/gs2/union/adjs/6141197/11/4?link_id=442 | 404 Not Found Content-Length: 4168 Content-Type: text/html | clean |
http://res.nie.netease.com/comm/js/jquery(mixNIE).last.js | 200 OK Content-Length: 109640 Content-Type: application/javascript | clean |
http://union.163.com/sys_js/parseuri.js | 200 OK Content-Length: 1055 Content-Type: application/x-javascript | clean |
http://union.163.com/sys_js/util.js?v=9 | 200 OK Content-Length: 25789 Content-Type: application/x-javascript | clean |
http://union.163.com/sys_js/gsweb.js?v=2 | 200 OK Content-Length: 1713 Content-Type: application/x-javascript | clean |
http://union.163.com/ | 200 OK Content-Length: 17044 Content-Type: text/html | clean |
http://res.nie.netease.com/union/js/script.js | 200 OK Content-Length: 1876 Content-Type: application/javascript | clean |
http://img.nie.163.com/web_frame/autours/autours_min.js | 200 OK Content-Length: 7052 Content-Type: application/javascript | clean |
http://union.163.com/gs2/union/logout | HTTP/1.1 303 See Other Connection: close Date: Wed, 14 May 2014 18:39:24 GMT Location: http://reg.163.com/Logout.jsp?username=&url=http%3A%2F%2Funion.163.com Server: nginx/1.4.4 Content-Type: text/html; charset=gbk | clean |
http://reg.163.com/logout.jsp?username=&url=http%3a%2f%2funion.163.com | 404 Not Found Content-Length: 5348 Content-Type: text/html | clean |
http://analytics.163.com/ntes.js | 200 OK Content-Length: 19378 Content-Type: application/x-javascript | clean |
http://union.163.com/UserLogin.shtml | 404 Not Found Content-Length: 4168 Content-Type: text/html | clean |
http://union.163.com/fab.html | 200 OK Content-Length: 3915 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) function rand(num) { return Math.floor(Math.random()*num)+1; } document.write("<iframe src=\"http://allyes.nie.163.com/main/adftrack?db=afanie&point=910&cache="+rand(9999999)+"&pre="+escape(document.referrer)+"\" width=\"0\" height=\"0\"><\/iframe>"); Antivirus reports:
| ||
http://res.nie.netease.com/union/qt/2012/0417_fab/js/com.js | 200 OK Content-Length: 672 Content-Type: application/javascript | clean |
http://union.163.com/gs2/union/reg | 200 OK Content-Length: 9716 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) function rand(num) { return Math.floor(Math.random()*num)+1; } document.write("<iframe src=\"http://allyes.nie.163.com/main/adftrack?db=afanie&point=908&cache="+rand(9999999)+"&pre="+escape(document.referrer)+"\" width=\"0\" height=\"0\"><\/iframe>"); Antivirus reports:
| ||
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: webgame.jyc.la
Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 14 May 2014 18:39:15 GMT
Server: nginx/1.0.8
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.5.10
GET / HTTP/1.1
Host: webgame.jyc.la
Result:
HTTP/1.1 200 OK
Connection: close
Date: Wed, 14 May 2014 18:39:15 GMT
Server: nginx/1.0.8
Content-Type: text/html; charset=utf-8
X-Powered-By: PHP/5.5.10
Second query (visit from search engine):
GET / HTTP/1.1
Host: webgame.jyc.la
Referer: http://www.google.com/search?q=webgame.jyc.la
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: webgame.jyc.la
Referer: http://www.google.com/search?q=webgame.jyc.la
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=webgame.jyc.la
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://webgame.jyc.la/
Result: webgame.jyc.la is not infected or malware details are not published yet.
Result: webgame.jyc.la is not infected or malware details are not published yet.