See: http://urlquery.net/report.php?id=1420588799354 → SURICATA TLS invalid handshake message
IDS alert on IP - https://www.virustotal.com/nl/ip-address/173.194.116.106/information/
See: http://myip.ms/info/whois/185.11.125.210/k/4069287827/website/www.nirgoldshlager.com
Quttera blacklisted external links: hxtp://www.2shared.com/file/90mjfuab/blogger_get_administrator_priv.html
htxp://touch.facebook.com/apps/myapp
htxps://touch.facebook.com/#%21/xx/%23%21/messages
htxp://touch.facebook.com/
blacklisted domains/hosts: wXw.2shared.com
touch.facebook dot com
Maybe the informational code like Flash New Attacking vectors on site = %27vbscript:alert%286%29%27%3E%3Cfont%20size=%22100%22%20%3EClick%20Me%20For%20XSS%3C/font%3E%3C/a%3E%3C%3E my malcode detector extension flags this…
The security info site is not actually been blacklisted…
Site benign: http://zulu.zscaler.com/submission/show/fa7135bd765f2a8711ad9a7d08681105-1420593279
Code errors given: error: undefined variable gadgets
error: undefined variable gadgets.rpc
error: line:1: SyntaxError: missing ; before statement:
error: line:1: var gadgets.rpc = 1;
error: line:1: …^
&
error: line:3: SyntaxError: missing = in XML attribute:
error: line:3: How I Hacked Facebook OAuth To Get Full Permission On Any
error: line:3: …^
//eval var _WidgetManager - eval not in global scope? change to:
if (window.execScript) {
window.execScript(text); // eval in global scope for IE
} else {
window.eval(text);
}
code creditsgo to Onno Hensgen
See: http://jsunpack.jeek.org/?report=58a61281f6a3171831f071bd83e06ace18199c94
Link for security researchers only, open up in browser with NoScript extension active and browser inside a VM/sandbox.
polonus