tags:

views:

843

answers:

7
+2  Q: 

Why so many web pages contain such a strange code snippet in header?

I've noticed for quite a long time that strange domains such like jsev.com, cssxx.com appered in my firefox status bar from time to time, I always wonder why so many web pages contains resources from these strange domains. I googled it, but found nothing. I guess it's some kind of virus which infect the servers and insert the code. Here is a sample taken from page header of http://www.eflorenzano.com/threadexample/blog/:

<script language="javascript" src="http://i.jsev.com./base.2032621946.js"&gt; </script>
<body onmousemove="return fz3824();">
<LINK REL="stylesheet" TYPE="text/css" HREF="http://i.cssxx.com./base2032621947.css"&gt;
<A HREF = "http://i.html.com./base2032621947.html"&gt;&lt;/A&gt;
<SCRIPT LANGUAGE="JAVASCRIPT" SRC="http://i.js.com./base2032621947.js"&gt;&lt;/SCRIPT&gt;
<SCRIPT LANGUAGE="JAVASCRIPT">
function getuseragnt()
{ var agt = navigator.userAgent.toLowerCase();
  agt = agt.replace(/ /g, "");
  return agt;
}
document.write("<LINK REL='stylesheet' TYPE='text/css' HREF='http://i.css2js.com./base.css" + getuseragnt() + "_2032621947'>") 
</SCRIPT>

edit: I am on a debian box, only on firefox I see this code, I just tried opera, this code doesn't appear in opera, really strange, never heard of firefox having such problems.

+3  A: 

It may be a browser worm installed on your machine. Should scan entire system.

mucit  2008-10-16 20:38:45
+2  A: 

I see nothing unusual about that page. Check your system. Here's the code I received:

<head><title>Tutorial 2</title>
<link rel="stylesheet" type="text/css" href="http://yui.yahooapis.com/2.4.1/build/reset/reset-min.css"&gt;
<link rel="stylesheet" type="text/css" href="http://media.eflorenzano.com/css/example2.css"&gt;
<script type="text/javascript" src="http://media.eflorenzano.com/js/jquery-1.2.2.min.js"&gt;&lt;/script&gt;
<script type="text/javascript" src="http://media.eflorenzano.com/js/jquery.form.js"&gt;&lt;/script&gt;

<script type="text/javascript">
    var _POSTER = '';
    var _FORM = '<textarea id="id_comment" rows="10" cols="40" name="comment"></textarea>';
    var _FORM_URL = '/threadexample/threadedcomments/comment/9/1/json/';
    var _REGISTER_URL = '/threadexample/register';
    var _CHECK_EXISTS_URL = '/threadexample/check_exists';
    var _LOGIN_URL = '/threadexample/login';
    var _IS_FOCUSED = null;
    var _ARROW_IMG_BASE = 'http://media.eflorenzano.com/img/arrow_';
    var _VOTE_BASE = '/threadexample/vote/';
</script>

<script type="text/javascript" src="http://media.eflorenzano.com/js/example2.js"&gt;&lt;/script&gt;
</head>
John Millikin  2008-10-16 20:39:43
A: 

That could very well be the case, as this does kinda look like some shady code. What if you use a different computer, does the source look the same?

Eric Wendelin  2008-10-16 20:40:32
A: 

Hm ... No solution here, but as a datapoint: It doesn't look at all like that for me (Firefox 3.0.3, in Gentoo Linux). I get the following interesting elements in the header:

<link rel="stylesheet" type="text/css" href="http://yui.yahooapis.com/2.4.1/build/reset/reset-min.css">
<link rel="stylesheet" type="text/css" href="http://media.eflorenzano.com/css/example2.css">
<script type="text/javascript" src="http://media.eflorenzano.com/js/jquery-1.2.2.min.js">
<script type="text/javascript" src="http://media.eflorenzano.com/js/jquery.form.js">
[...]
<script type="text/javascript" src="http://media.eflorenzano.com/js/example2.js">

This looks fairly clean to me; four references to resources on the same server, plus one CSS from what looks like Yahoo!. Strange, I wonder why it looked so different for you. Hopefully some true web wizard can shed some light on that.

Also, I notice that all the weird-looking URI:s have domain names that end in a period, which I don't think is even legal. I Googled it, and found some old Digg thread, but was unable to locate the exact comment that mentioned the weird-looking URI:s. Strange.

unwind  2008-10-16 20:47:22
Domain names always implicitly end with a period. Your DNS resolver puts them there for you (behind the scenes). You can explicitly end them with a period and they work the same.
Barry Brown  2008-10-16 20:53:04
See http://en.wikipedia.org/wiki/FQDN
Barry Brown  2008-10-16 20:55:45
+3  A: 

DNS poisoning?

Michael Sharek  2008-10-16 20:55:54
+6  A: 

This happens if you are using one of Princeton university's CoDeeN project proxy servers. CoDeeN is an academic testbed content distribution network. When you browse a web page using CoDeeN proxy it injects some HTML code to the site's original HTML and redirects requests sent to pseudo adresses to the project's servers. Some of the pseudo addresses are: http://i.cssxx.com./base0877861956.css | i.cssxx.com. http://i.jsev.com./base.0877861955.js | i.jsev.com./ http://i.html.com./base0877861956.html | i.html.com. http://i.js.com./base0877861956.js | i.js.com./ http://i.css2js.com./base.css | i.css2js.com.

Some or all CoDeeN's proxy servers appear as anonymous proxy servers list. CoDeeN project page: http://codeen.cs.princeton.edu/

 2009-03-08 09:29:57
Interesting. Sounds something like the next step for ISP/internet providers.
Tchalvak  2009-12-26 01:12:18
A: 

I agree with Mediashakers

That cause you're using CoDeeN project proxy servers

Try use no proxy, it will see the difference

john  2009-12-26 01:00:35

related questions

Autosizing Textarea
Regular expression for parsing links from a webpage?
What are good tools for creating compiled HTML help files (.chm)?
Looking for WYSIWYG HTML editor
Any reason not to start using the HTML 5 doctype?
HTML comments break down
HTML Comments Markup
Setting a div's height in HTML with CSS
Wrapping lists into columns
Is a "Confirm Email" input good practice when user changes email address?
<XMP> Tag
HTML version choice
Options for HTML scraping?
How do you disable browser Autocomplete on web form field / input tag?
How do I make a checkbox toggle from clicking on the text label as well?
Html CSS Editor
Wordpress theme development offline tools
How do I give my web sites an icon for iPhone?
In HTML, how to word-break on a dash?
Detecting font in JavaScript
How do you test layout design across multiple browsers/OSs?
How do I print an HTML document from a web service?
Multiple submit buttons on a HTML form
How can I determine a web user's time zone?
Why doesn't the percentage width child in absolutely positioned parent work in IE7?