Javascript with %%%%%%?

Discussion in 'Java' started by azwarking, Dec 21, 2007.

  1. azwarking

    azwarking Guest

    Hi,

    I had this guy post some spam to my site and now I'm on a mission to
    find out who it is. He's got a site that redirects you elsewhere, in
    that site I hit stop on the browser so I could see it. It contained
    this script:

    SCRIPT type='text/javascript'>
    var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
    %6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
    %74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
    %37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
    %31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
    %2f"+"%73%63%72%69p%74%3e";
    document.writeln(unescape(ibnfbpy));
    </SCRIPT

    Is it just a redirecting script or something else?
    azwarking, Dec 21, 2007
    #1
    1. Advertising

  2. On Dec 20, 11:49 pm, azwarking <> wrote:
    > Hi,
    >
    > I had this guy post some spam to my site and now I'm on a mission to
    > find out who it is.  He's got a site that redirects you elsewhere, in
    > that site I hit stop on the browser so I could see it.  It contained
    > this script:
    >
    > SCRIPT type='text/javascript'>
    > var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
    > %6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
    > %74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
    > %37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
    > %31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
    > %2f"+"%73%63%72%69p%74%3e";
    > document.writeln(unescape(ibnfbpy));
    > </SCRIPT
    >
    > Is it just a redirecting script or something else?


    Wrong group; comp.lang.javascript is -thataway-> and has nothing to do
    with Java. Followup-to set.

    Those patterns are URL-escaped byte values representing some text,
    followed by a short snippet of code to tell the javascript engine to
    print the un-escaped version of the string on the page. The byte
    values are probably ascii text; they're stored as pairs of hex digits,
    with one byte per %AB sequence. Decoding it yourself should be fairly
    trivial.

    -o
    Owen Jacobson, Dec 21, 2007
    #2
    1. Advertising

  3. azwarking wrote:

    > Hi,
    >
    > I had this guy post some spam to my site and now I'm on a mission to
    > find out who it is. He's got a site that redirects you elsewhere, in
    > that site I hit stop on the browser so I could see it. It contained
    > this script:
    >
    > SCRIPT type='text/javascript'>
    > var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
    > %6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
    > %74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
    > %37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
    > %31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
    > %2f"+"%73%63%72%69p%74%3e";
    > document.writeln(unescape(ibnfbpy));
    > </SCRIPT
    >
    > Is it just a redirecting script or something else?
    >

    Please ask in comp.lang.javascript
    --
    Sabine Dinis Blochberger

    Op3racional
    www.op3racional.eu
    Sabine Dinis Blochberger, Dec 21, 2007
    #3
  4. azwarking

    Daniel Pitts Guest

    azwarking wrote:
    > Hi,
    >
    > I had this guy post some spam to my site and now I'm on a mission to
    > find out who it is. He's got a site that redirects you elsewhere, in
    > that site I hit stop on the browser so I could see it. It contained
    > this script:
    >
    > SCRIPT type='text/javascript'>
    > var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
    > %6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
    > %74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
    > %37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
    > %31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
    > %2f"+"%73%63%72%69p%74%3e";
    > document.writeln(unescape(ibnfbpy));
    > </SCRIPT
    >
    > Is it just a redirecting script or something else?
    >

    While others have correctly pointed you to the proper newsgroup, I
    happened to find the answer you need :)

    Yes, the encoded the redirect into a obfuscated text.

    It redirects to some spam site.

    --
    Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>
    Daniel Pitts, Dec 21, 2007
    #4
  5. azwarking

    azwarking Guest

    On Dec 21, 11:58 am, Daniel Pitts
    <> wrote:
    > azwarking wrote:
    > > Hi,

    >
    > > I had this guy post some spam to my site and now I'm on a mission to
    > > find out who it is. He's got a site that redirects you elsewhere, in
    > > that site I hit stop on the browser so I could see it. It contained
    > > this script:

    >
    > > SCRIPT type='text/javascript'>
    > > var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
    > > %6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
    > > %74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
    > > %37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
    > > %31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
    > > %2f"+"%73%63%72%69p%74%3e";
    > > document.writeln(unescape(ibnfbpy));
    > > </SCRIPT

    >
    > > Is it just a redirecting script or something else?

    >
    > While others have correctly pointed you to the proper newsgroup, I
    > happened to find the answer you need :)
    >
    > Yes, the encoded the redirect into a obfuscated text.
    >
    > It redirects to some spam site.
    >
    > --
    > Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>


    Thanks Daniel! LOL... big smile...
    azwarking, Dec 21, 2007
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. mcdeveloper
    Replies:
    1
    Views:
    4,186
    mcdeveloper
    Jun 13, 2006
  2. CRON
    Replies:
    24
    Views:
    200,647
    Adrienne Boswell
    Jun 20, 2006
  3. Mark Rae

    JavaScript or not JavaScript

    Mark Rae, Sep 5, 2006, in forum: ASP .Net
    Replies:
    36
    Views:
    1,085
    Paul Sture
    Sep 9, 2006
  4. Nathan Sokalski
    Replies:
    4
    Views:
    577
    PJ on Development
    Nov 8, 2007
  5. Lisa Calla
    Replies:
    0
    Views:
    270
    Lisa Calla
    Nov 9, 2004
Loading...

Share This Page