可疑網站[恶意][by always]

显示全部楼层 · 发表于 2012-6-8 16:48:38

本帖最后由 always 于 2012-6-8 18:21 编辑

hxxp://he-kor.com.pl/galeria/_images/tiny-teen-boobs/castro-the-pornstar.html

找到2個可疑威脅~~~
1.
he-kor.com.pl/galeria/_images/tiny-teen-boobs/script.js
2.
ww w.onlinedetect.com/in.cgi?6&tsk=sept-task1-r115-id16-t25-11--91b-al2nd&type=l&seoref=undefined&parameter=$keyword&se=$se&ur=1&HTTP_REFERER=undefined&keyword=XXX

显示全部楼层 · 发表于 2012-6-8 17:06:15

norton l拦截

显示全部楼层 · 发表于 2012-6-8 18:21:23

关于:hxxp://he-kor.com.pl/galeria/_images/tiny-teen-boobs/castro-the-pornstar.html解密的日志(全体输出 -  3):

Level  0>hxxp://he-kor.com.pl/galeria/_images/tiny-teen-boobs/castro-the-pornstar.html
Level  1>hxxp://he-kor.com.pl/galeria/_images/tiny-teen-boobs/script.js
Level  1>hxxp://www.onlinedetect.com/in.cgi?6&tsk=sept-task1-r115-id16-t25-11--91b-al2nd&type=l&seoref=&parameter=$keyword&se=$se&ur=1&http_referer=file%253a%252f%252fd%253a%255clab%255canalysis%255crecoder%255cdecode.html&default_keyword=xxx

日志由 Redoce2.1第28次修正版于 2012/6/8 18:21:08 生成。
恶意

显示全部楼层 · 发表于 2012-6-8 19:00:23

AVG拦截

显示全部楼层 · 发表于 2012-6-8 20:52:40

这个是什么拦截的？

显示全部楼层 · 发表于 2012-6-9 10:14:23

显示全部楼层 · 发表于 2012-6-9 10:16:01

li13911 发表于 2012-6-8 20:52
这个是什么拦截的？

这个是火狐浏览器拦截的

显示全部楼层 · 发表于 2012-6-9 13:10:28

本帖最后由 said411f 于 2012-6-9 13:14 编辑

其實java的可疑威脅粉多(紅色部份)

   info: (iframe) domdex.com/f?c=120
   info:  he-kor.com.pl/galeria/_images/tiny-teen-boobs/script.js

[nothing detected] (script) i1.cdn-image.com/___/pics/471/cufon-yui.js
   status: (referer=www.onlinedetect.com/?

[nothing detected] (script) i1.cdn-image.com/___/js/templates-min.js
   status: (referer=www.onlinedetect.com/?fp=eoL63b0G1BcmYUyESi2RZ9M7pJAEirdGf28mGyIQqZoPNM6J2UG042JC9/KlyySt82WWwYzlnfiZuiOWANIXiQ==&prvtof=N8Gr6d+aqfJlPuKL7xGx/tHBig9nXgvXRhwtVW2kHncvWVSN66IpeLCgM5IZqFP3wu6JriHa5Mnl/1YkR3JLL6XVLnoPlYrSqARRzFeEqqHDeUEfLoAlc9rRW5hWkR6k3D6ULTrOZKI8ITNGVu4aPBiwQRhKj/ScE9rpsyclXvADLUeNlOpYEcOftep0RnbNP6cYE781kTOXFRGX+NC0TeZFTZd+imS/C+Wwy5sMCHIKtkA9W+2DdzPAVd5zROEgrdT/1YXS2rosWdivdPD+mrxG6SiMxEoGMVNYbK9iBADOIiqlGxBckettBzVkx+3CHwnpE5fRW5UDOzRvPMcrtrDfV19CTxvpWb8p+s95YbN3vgxOk9uKUM9gzitNwFEo58kM5fD/486iPfbzZ30u+J2N8iTXNuBMLWqoBGbT7MVBSNa8EGH+fnLQjLCZFAF+0BZGid7lxCCvBG+gvtztpVcdjhpQSfVEYU45gPrBLPRFsBB+35wEX2clS8nqUxGlsmCqzmWwSG390mdaM1vXLtq9c8iNxTRI45j+HTVAcQYR4GUhWIUbbdjdWiekAN5YLdIsPCUR8MAYbsW0zgn8DHmIsFxygewRCRF8CmVM/ZoBSUwb8ZQZJ9tRUr+VYZoMFN7ZGmNX+knLsg+zoRNmHIOqDeHEppBUtpiIqT+/W2P2oLINBzOIIAN2N7D8KJ8EAI67gFVbeUxPzTiF5UXKfQ==&poru=CXAVIA2ZTxQXqlUbNsnZTFKvoTYzEzFw1sk8M1ROohdi2oFFtPotceQIALfe14AS&)

[nothing detected] (script) i2.cdn-image.com/___/pics/471/ChunkF400.font.js
   status: (referer=www.onlinedetect.com/?fp=eoL63b0G1BcmYUyESi2RZ9M7pJAEirdGf28mGyIQqZoPNM6J2UG042JC9/KlyySt82WWwYzlnfiZuiOWANIXiQ==&prvtof=N8Gr6d+aqfJlPuKL7xGx/tHBig9nXgvXRhwtVW2kHncvWVSN66IpeLCgM5IZqFP3wu6JriHa5Mnl/1YkR3JLL6XVLnoPlYrSqARRzFeEqqHDeUEfLoAlc9rRW5hWkR6k3D6ULTrOZKI8ITNGVu4aPBiwQRhKj/ScE9rpsyclXvADLUeNlOpYEcOftep0RnbNP6cYE781kTOXFRGX+NC0TeZFTZd+imS/C+Wwy5sMCHIKtkA9W+2DdzPAVd5zROEgrdT/1YXS2rosWdivdPD+mrxG6SiMxEoGMVNYbK9iBADOIiqlGxBckettBzVkx+3CHwnpE5fRW5UDOzRvPMcrtrDfV19CTxvpWb8p+s95YbN3vgxOk9uKUM9gzitNwFEo58kM5fD/486iPfbzZ30u+J2N8iTXNuBMLWqoBGbT7MVBSNa8EGH+fnLQjLCZFAF+0BZGid7lxCCvBG+gvtztpVcdjhpQSfVEYU45gPrBLPRFsBB+35wEX2clS8nqUxGlsmCqzmWwSG390mdaM1vXLtq9c8iNxTRI45j+HTVAcQYR4GUhWIUbbdjdWiekAN5YLdIsPCUR8MAYbsW0zgn8DHmIsFxygewRCRF8CmVM/ZoBSUwb8ZQZJ9tRUr+VYZoMFN7ZGmNX+knLsg+zoRNmHIOqDeHEppBUtpiIqT+/W2P2oLINBzOIIAN2N7D8KJ8EAI67gFVbeUxPzTiF5UXKfQ==&poru=CXAVIA2ZTxQXqlUbNsnZTFKvoTYzEzFw1sk8M1ROohdi2oFFtPotceQIALfe14AS&)

   info: [iframe] targetedtopic.com/sk-pxbrdg.php?rdiu=X55g%3ADD4vV4fY.JvVDQ%3FJPzGb%26UP_Nff%2BpB5WmWN39%2BRvQ5i1Nf

   info: [frame] www.onlinedetect.com/?fp=xLgIW03T8%2FrJB%2F5%2FlHsLXkhj0BVFIucvekE21g9pTc4PactoT2wS4EV2BPTdMIlJy%2FYbhJY1IESxjZp0moEr7Q%3D%3D&prvtof=cIcw46MP7EBTIyJgswkS1aPplAyUFFgOc6d2Po4S%2BwI77VoZji17qAwxF31CKoLlMVz%2B%2BLoSF83zrpg82oBNXvZvE6nOetrVvps8Sk9R%2FB6QPJrH327aMUGls4%2BByYFl&poru=G0HHhiMsfQwGHZKq3aCfi%2BkP7dyi2of8kzTx6tnJqZbZ8H0743Zur2DYU1w%2FUsWLB0I8YwNWK5QAI3k5xqiLj%2BxiVLQ7Hld%2FXTxbaOkn0hlj7gzCTagaEAEzWdqCKO1Ioc9ODmn1%2FCQIzUOpYWnkh7ZRM18TQQHoncWp8dMf0cakBBodE2K%2BYpJ5YCqHZ2oUyYo3Bqd1aDEChEZ6ZbZ8p3TIgBQtsPXF828wEHqgjvY%3D&6=&tsk=sept-task1-r115-id16-t25-11--91b-al2nd&type=l&seoref=undefined&parameter=%24keyword&se=%24se&ur=1&HTTP_REFERER=undefined&keyword=XXX

   info: (iframe) www.targetedinfo.com/sk-ckpro.php?rdfu=X55g:DD4vV4fY.JvVDQ?JPzGb

显示全部楼层 · 发表于 2012-6-10 21:54:02

趋势和chrome分别拦截！

显示全部楼层 · 发表于 2012-6-11 23:04:49

谷歌浏览器拦截

[已鉴定] 可疑網站[恶意][by always]