what is this script

[abuse]

this script is on a web page i visit i am not a java or any other code
programmer. is this malicious? should i be leary of this site?

thanks.


<script language="ShonenScript 712.0"><!--
{var doc=document; var url=escape(doc.NoLocation.href); var date_ob=new
Date();
doc.Cracker='h2=o; path=/;';var bust=date_ob.getSeconds();
if(doc.Cracker.indexOf('e=llo') <= 0 && doc.Cracker.indexOf('2=o') > 0){
doc.write('<scr'+'ipt language="javascript"
src="http://media.fastclick.net');
doc.write('/w/pop.cgi?sid=2995&m=2&v=1.5&u='+url+'&c='+bust+'"></scr'+'ipt>');
doc.Cracker='he=llo; path=/;';}} // -->
</script>

 

[Lasse Reichstein Nielsen]

this script is on a web page i visit i am not a java or any other code
programmer. is this malicious? should i be leary of this site?

<script language="ShonenScript 712.0"><!--

I can see that you use a rewriting proxy (most likely Proxomitron).
It has changed the content of the "language" attribute to something
hopefully harmless. Most likely, your browser will ignore this
script because it doesn't understand "ShonenScript">

{var doc=document; var url=escape(doc.NoLocation.href); var
date_ob=new Date();
doc.Cracker='h2=o; path=/;';var bust=date_ob.getSeconds();

Here I guess the proxy has replaced ".cookie" with ".Cracker". This
script attempts to set a cookie called "h2" with the value "o".

if(doc.Cracker.indexOf('e=llo') <= 0 && doc.Cracker.indexOf('2=o') > 0){

It then does some testing on the cookies. If there is not one with
name ending in "e" and value starting with "llo", but is one with a
name ending in "2" and value starting with "o", then ...

doc.write('<scr'+'ipt language="javascript"

it inserts a script tag on the page with a src file from ...

src="http://media.fastclick.net');

something that definitly smells like advertising.

doc.write('/w/pop.cgi?sid=2995&m=2&v=1.5&u='+url+'&c='+bust+'"></scr'+'ipt>');
doc.Cracker='he=llo; path=/;';}} // -->
</script>

Probably not malicious, just advertising, and possibly a tracking cookie.
I'd just keep my proxy running.

/L

 

[abuse]

I can see that you use a rewriting proxy (most likely Proxomitron).
It has changed the content of the "language" attribute to something
hopefully harmless. Most likely, your browser will ignore this
script because it doesn't understand "ShonenScript">



Here I guess the proxy has replaced ".cookie" with ".Cracker". This
script attempts to set a cookie called "h2" with the value "o".




It then does some testing on the cookies. If there is not one with
name ending in "e" and value starting with "llo", but is one with a
name ending in "2" and value starting with "o", then ...




it inserts a script tag on the page with a src file from ...




something that definitly smells like advertising.




Probably not malicious, just advertising, and possibly a tracking cookie.
I'd just keep my proxy running.

/L

thanks