Author Topic: ET WEB_CLIENT Hex Obfuscation of document.write % Encoding alert on website!  (Read 965 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
See: https://urlquery.net/report/e5120757-5137-45a4-b0c9-e65f2545b5c1
Re: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=zeijen.nu&ref_sel=GSP2&ua_sel=ff&fs=1
Quote
The scan has detected some potential problems in these files. First scroll down through the code listed out after the list of links, this is the code returned by the request for the URL you entered and check for any problems. Next, these link(s) will open the individual URL(s) in this tool, check through the code that is returned, compare the code being returned to a know clean copy, etc.
Suspicious code
Quote
< td title="E-mail xxxx xxxxx" colspan="2"> < sc​ript type="text/javascript"> eval(un​escape ('%​64%​6f%​63%​75%​6d%​65%​6e%​74%​2e%​77%​72%​69%​74%​65%​28%​27%​3c%​61%​20%​68%​72%​65%​66%​3d%​22%​6d%​61%​69%​6c%​74%​6f%​3a%​7a%​65%​69%​6a%​65%​6e%​6e%​75%​40%​68%​6f%​74%​6d%​61%​69%​6c%​2e%​63%​6f%​6d%​3f%​73%​75%​62%​6a%​65%​63%​74%​3d%​54%​2e%​61%​2e%​76%​2e%​25%​32%​30%​48%​65%​6e%​6b%​25%​32%​30%​44%​75%​69%​74%​22%​20%​3e%​45%​2d%​6d%​61%​69%​6c%​3c%​2f%​61%​3e%​27%​29%​3b'))<
looks safe to use: https://www.scamadviser.com/check-website/zeijen.nu

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!