Hi,
I had this guy post some spam to my site and now I'm on a mission to
find out who it is. He's got a site that redirects you elsewhere, in
that site I hit stop on the browser so I could see it. It contained
this script:
SCRIPT type='text/javascript'>
var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
%6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
%74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
%37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
%31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
%2f"+"%73%63%72%69p%74%3e";
document.writeln(unescape(ibnfbpy));
</SCRIPT
Is it just a redirecting script or something else?
Owen Jacobson - 21 Dec 2007 08:43 GMT
> Hi,
>
[quoted text clipped - 14 lines]
>
> Is it just a redirecting script or something else?
Wrong group; comp.lang.javascript is -thataway-> and has nothing to do
with Java. Followup-to set.
Those patterns are URL-escaped byte values representing some text,
followed by a short snippet of code to tell the javascript engine to
print the un-escaped version of the string on the page. The byte
values are probably ascii text; they're stored as pairs of hex digits,
with one byte per %AB sequence. Decoding it yourself should be fairly
trivial.
-o
Sabine Dinis Blochberger - 21 Dec 2007 09:28 GMT
> Hi,
>
[quoted text clipped - 14 lines]
>
> Is it just a redirecting script or something else?
Please ask in comp.lang.javascript

Signature
Sabine Dinis Blochberger
Op3racional
www.op3racional.eu
Daniel Pitts - 21 Dec 2007 18:58 GMT
> Hi,
>
[quoted text clipped - 14 lines]
>
> Is it just a redirecting script or something else?
While others have correctly pointed you to the proper newsgroup, I
happened to find the answer you need :-)
Yes, the encoded the redirect into a obfuscated text.
It redirects to some spam site.

Signature
Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>
azwarking - 21 Dec 2007 20:03 GMT
On Dec 21, 11:58 am, Daniel Pitts
<newsgroup.spamfil...@virtualinfinity.net> wrote:
> > Hi,
>
[quoted text clipped - 24 lines]
> --
> Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>
Thanks Daniel! LOL... big smile...