See: http://killmalware.com/obpan.pl/#
See: http://toolbar.netcraft.com/site_report?url=http://obpan.pl
Going to the reversed DNS we get this: aco93.rev.netart.pl and there we have: -http://kf.nazwa.pl/index_creation.php
It is just like an invitation on a “welcome” doormat, isn’t it?
Getting us to the following scripts: Scanning -http://kf.nazwa.pl/index_creation.php …
Script loaded: -http://content.netart.pl/www/delivery/spcjs.php?id=5&target=_top
Script loaded: -http://content.netart.pl/www/delivery/fl.js
Script loaded: -http://content.netart.pl/www/delivery/spc.php?zones=5&source=&r=3933865&target=_top&charset=ISO-8859-1&loc=http%3A//kf.nazwa.pl/index_creation.php
http://www.domxssscanner.com/scan?url=http%3A%2F%2Fkf.nazwa.pl%2Findex_creation.php
landing here: Results from scanning URL: -http://content.netart.pl/www/delivery/spcjs.php?id=5&target=_top
Number of sources found: 14
Number of sinks found: 3
kicking up
found JavaScript
error: line:4: SyntaxError: missing ; before statement:
error: line:4: .^
→ https://urlquery.net/report.php?id=1454075310251
found JavaScript
error: line:11: SyntaxError: missing ; before statement:
error: line:11: <script src='http:/www.google-analytics.com/ga.js' type='text/javascript'></script>
error: line:11: .^
Variable re-declared.
polonus (volunteer website security analyst and website error-hunter)