See flagged twice here: https://www.virustotal.com/nl/url/11475ab2bf8fdb7752fcdebbe6252f907220ba494473a3bde1a81a0e52aa4e42/analysis/1385820310/
is or was distributing a malware variant of HTML/IFRAME.gen
Cannot be reached: Normalized URL:
htxp://hnyr.gov.cn
Last scan date:
30-11-2013 15:07:48
Current status:
Address is unreachable
Given as clean:
http://maldb.com/www.hnyr.gov.cn/
iFrame suspicious: zhuanhuan/sample.jsp’ (this is servlet code)
Injection check: Suspicious Text after HTML
Code hick-up on site:
info: [img] img.webscan.360 dot cn/status/pai/hash/a0291c8626b21b213980f62f387a8b61
info: [decodingLevel=0] found JavaScript
error: undefined variable MiniSite
error: undefined variable MiniSite.Weather
error: line:1: SyntaxError: missing ; before statement:
error: line:1: var MiniSite.Weather = 1;
error: line:1: …^
info: [decodingLevel=1] found JavaScript
suspicious:
No detections
but detections recently: https://urlquery.net/report.php?id=6424530 namely heap spray attempts in order to infest via IE
polonus