Malicious/Suspicious Redirects
Request | Server response | Status |
URL: http://yourdevice.net/ (imitation of visitor from search engine) GET / HTTP/1.1 Host: yourdevice.net Referer: http://www.google.com/search?q=redirect+check1 | HTTP/1.1 302 Found Connection: close Date: Thu, 12 Sep 2013 10:24:18 GMT Location: http://chilli-recipes.com/administrator/includes/joomla.php Server: Apache/2.2.17 (Unix) PHP/5.2.17 Content-Length: 0 Content-Type: text/html X-Powered-By: PHP/5.2.17 | malicious |
URL: http://chilli-recipes.com/administrator/includes/joomla.php (imitation of visitor from search engine) GET /administrator/includes/joomla.php HTTP/1.1 Host: chilli-recipes.com Referer: http://www.google.com/search?q=redirect+check2 | HTTP/1.1 302 Moved Temporarily Connection: close Date: Thu, 12 Sep 2013 10:24:18 GMT Location: http://www.mangacompass.altervista.org/libraries/pear/tard/www/all2.php Server: Apache/2.4.6 (Unix) Content-Length: 0 Content-Type: text/html X-Powered-By: PHP/5.2.17 | malicious |
URL: http://www.mangacompass.altervista.org/libraries/pear/tard/www/all2.php (imitation of visitor from search engine) GET /libraries/pear/tard/www/all2.php HTTP/1.1 Host: www.mangacompass.altervista.org Referer: http://www.google.com/search?q=redirect+check3 | HTTP/1.1 302 Moved Temporarily Connection: close Date: Thu, 12 Sep 2013 10:24:19 GMT Location: http://yahoo.com Server: Apache Content-Type: text/html | malicious |
Scanned pages/files
Request | Server response | Status |
http://yourdevice.net/ | 200 OK Content-Length: 25275 Content-Type: text/html | clean |
http://yourdevice.net/media/system/js/caption.js | 200 OK Content-Length: 1963 Content-Type: application/javascript | clean |
http://yourdevice.net/modules/mod_rokajaxsearch/js/rokajaxsearch.js | 200 OK Content-Length: 15778 Content-Type: application/javascript | clean |
http://yourdevice.net/templates/cycletheme/js/mootools_release-1.11.js | 200 OK Content-Length: 88505 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) var MooTools = { version: '1.11' }; function $defined(obj){ return (obj != undefined); }; function $type(obj){ if (!$defined(obj)) return false; if (obj.htmlElement) return 'element'; var type = typeof obj; if (type == 'object' && obj.nodeName){ switch(obj.nodeType){ case 1: return 'element'; case 3: return (/\S/).test(obj.nodeValue) ? 'textnode' : 'whitespace'; } } if (type == 'object' || type == 'function this.elements.each(function(el, i){ obj[i] = {}; var hide = (i != index) || (this.options.alwaysHide && (el.offsetHeight > 0)); this.fireEvent(hide ? 'onBackground' : 'onActive', [this.togglers[i], el]); for (var fx in this.effects) obj[i][fx] = hide ? 0 : el[this.effects[fx]]; }, this); return this.start(obj); }, showThisHideOpen: function(index){return this.display(index);} }); Fx.Accordion = Accordion; Antivirus reports:
| ||
http://yourdevice.net/templates/cycletheme/js/fx_styles.js | 200 OK Content-Length: 733 Content-Type: application/javascript | clean |
http://yourdevice.net/templates/cycletheme/js/accordion.js | 200 OK Content-Length: 313 Content-Type: application/javascript | clean |
http://yourdevice.net/templates/cycletheme/js/backgroundslider.js | 200 OK Content-Length: 3198 Content-Type: application/javascript | clean |
http://yourdevice.net/templates/cycletheme/js/slideshow.js | 200 OK Content-Length: 8950 Content-Type: application/javascript | clean |
http://yourdevice.net/swfobject.js | 200 OK Content-Length: 5955 Content-Type: application/javascript | clean |
http://yourdevice.net/themes/garland/swfobject.js | 404 Not Found Content-Length: 303 Content-Type: text/html | clean |
http://yourdevice.net/test404page.js | 404 Not Found Content-Length: 290 Content-Type: text/html | clean |
http://tools.spylog.ru/counter_cv.js | 200 OK Content-Length: 5362 Content-Type: application/x-javascript | clean |
http://yourdevice.net//mc.yandex.ru/metrika/watch.js/ | 404 NOT FOUND Content-Length: 25275 Content-Type: text/html | clean |
http://yourdevice.net/projekt/ | 200 OK Content-Length: 35432 Content-Type: text/html | clean |
http://yourdevice.net/uslugi/ | 200 OK Content-Length: 22294 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=yourdevice.net
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://yourdevice.net/
Result: yourdevice.net is not infected or malware details are not published yet.
Result: yourdevice.net is not infected or malware details are not published yet.