Malicious iFrame redirect? Avast Webshield detects JS:Clickjack-B [Trj] 

polonus · 2015-03-26T23:16:17.000Z

Website redirects to htxp://www.mascompu.com/solylunadecoraciones/
→ https://www.virustotal.com/en/url/64af83f25604469c6181127cccd0d30eb180272a8ba4eddad69f87bebfebdfd9/analysis/1427410660/
Nothing here: http://quttera.com/detailed_report/solylunadecoraciones.com
Nor here: http://sitecheck.sucuri.net/results/solylunadecoraciones.com
Two warnings here: https://asafaweb.com/Scan?Url=solylunadecoraciones.com
Obfuscated script: http://www.webpagescreenshot.info/img/55149139660e90-98398927
Javascript check detects: Suspicious

script type=“text/javascript”>eval(string.fromcharcode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,34,60,115,116,121,108,101,32,117,110,100,101,102,105,110,101,100,6
Joomla hack? http://stackoverflow.com/questions/15237789/how-to-reverse-engineer-a-hidden-js-script

On the original page we found:

 <frameset rows="100%,*" border="0">
  <frame src="htxp://www.mascompu.com/solylunadecoraciones" frameborder="0" />
  <frame frameborder="0" noresize />
</frameset>

→ http://www.webdataexperts.com/domain/solylunadecoraciones.com

We are being protected as Avast Webshiekld detects JS:Clickjack-B [Trj] for this website.

polonus

polonus · 2015-03-26T23:57:22.000Z

On VT Scan I get also this https://www.virustotal.com/en/file/23bd752fe44da33da7d474fefe07b70f68c13eb3711b54def9c1e6f488762e0b/analysis/1427405708/
Avast detecting JS:HideLink-A [Trj] here: https://www.virustotal.com/en/url/92a2293c5a95361f76e1513c9cbc88e14437221e48e86d686d903346c646f576/analysis/1427414135/

polonus

Announcements