Scanned pages/files
Request | Server response | Status |
http://zomafoto.com/ | 200 OK Content-Length: 9240 Content-Type: text/html | suspicious |
Malicious code - confirmed by antiviruses (see below) window.scrollBy(0,1) window.resizeTo(0,0) window.moveTo(0,0) setTimeout("move()",1);var mxm=50 var mym=25 var mx=0 var my=0 var sv=50 var status=1 var szx=0 var szy=0 var c=255 var n=0 var sm=30 var cycle=2 var done=2 function move() {if(status==1) {mxm=mxm/1.05 mym=mym/1.05 mx=mx mxm my=my-mym mxm=mxm(400-mx)/100 mym=mym-(300-my)/100 window.moveTo(mx,my) rmxm=Math.round(mxm/10) rmym=Math.roun cycle=cycle-1 if(cycle>0) {if(done==1) {status=7} else {status=4}}}} if(status==6) {document.title="Cljck" alert("Cljck") cycle=2 status=4 done=1} if(status==7) {c=c 4 document.bgColor=c*65536 document.fgColor=(255-c)*65536 if(c>128) {status=8}} if(status==8) {window.moveTo(0,0) sx=screen.availWidth sy=screen.availHeight window.resizeTo(sx,sy) status=9} var timer=setTimeout("move()",0.3)} Antivirus reports:
Deface/Content modification. The following signature was found: Hacked By Faltu Pola <!Copy Rights are only for Faltu Pola "> <HTML><HEAD><META http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link REL="SHORTCUT ICON" HREF="http://fc01.deviantart.net/fs40/i/2009/010/0/9/Bangladesh_Grunge_Flag_by_think0.jpg"> <script language="JavaScript">var left="|| Faltu Pola ||";var right="|| Faltu Pola ||";var msg=" Hacked By Faltu Pola ";var speed=200;function scroll_title(){document.title=left msg right;msg=msg.substring(1,msg.length)msg.charAt(0);setTimeout("scroll_title()",speed);} scroll_title();</script> <style type="text/css">.style1{color:red;font-size:x-large;font-weight:bold}</style> </HEAD> <BODY bgcolor="#000000"> <CENTER> <p align="center"> <br><br> <DIV style ...[10303 bytes skipped]... | ||
http://zomafoto.com/test404page.js | 200 OK Content-Length: 9254 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) window.scrollBy(0,1) window.resizeTo(0,0) window.moveTo(0,0) setTimeout("move()",1);var mxm=50 var mym=25 var mx=0 var my=0 var sv=50 var status=1 var szx=0 var szy=0 var c=255 var n=0 var sm=30 var cycle=2 var done=2 function move() {if(status==1) {mxm=mxm/1.05 mym=mym/1.05 mx=mx mxm my=my-mym mxm=mxm(400-mx)/100 mym=mym-(300-my)/100 window.moveTo(mx,my) rmxm=Math.round(mxm/10) rmym=Math.roun cycle=cycle-1 if(cycle>0) {if(done==1) {status=7} else {status=4}}}} if(status==6) {document.title="Cljck" alert("Cljck") cycle=2 status=4 done=1} if(status==7) {c=c 4 document.bgColor=c*65536 document.fgColor=(255-c)*65536 if(c>128) {status=8}} if(status==8) {window.moveTo(0,0) sx=screen.availWidth sy=screen.availHeight window.resizeTo(sx,sy) status=9} var timer=setTimeout("move()",0.3)} Antivirus reports:
|
Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: zomafoto.com
Result:
HTTP/1.1 200 OK
Cache-Control: max-age=0, no-cache
Connection: close
Date: Sun, 13 Apr 2014 11:12:09 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 9240
Content-Type: text/html; charset=UTF-8
X-Mod-Pagespeed: 1.6.29.7-3566
...9240 bytes of data.
GET / HTTP/1.1
Host: zomafoto.com
Result:
HTTP/1.1 200 OK
Cache-Control: max-age=0, no-cache
Connection: close
Date: Sun, 13 Apr 2014 11:12:09 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 9240
Content-Type: text/html; charset=UTF-8
X-Mod-Pagespeed: 1.6.29.7-3566
...9240 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: zomafoto.com
Referer: http://www.google.com/search?q=zomafoto.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: zomafoto.com
Referer: http://www.google.com/search?q=zomafoto.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=zomafoto.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://zomafoto.com/
Result: zomafoto.com is not infected or malware details are not published yet.
Result: zomafoto.com is not infected or malware details are not published yet.