Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend of mine received an email from someone (a reputable sender), and I noticed that the following was tagged onto the end of the subject:

</title><style>.axhg{position:absolute;clip:rect(484px,auto,auto,484px);}</style><div class=axhg><a href=(site) > (contents)


(site) = 116jurist(dot)ru
(contents) = þðèäè÷åñêèå-êîíñóëüòàöè

My question has two parts:

  1. Do the given contents mean anything? It looks like its encoded for XSS filter evasion, but I don't know what kind of encoding it could be. The contents may only be partial (may have been cut short in the subject line).

  2. Is there something that I can/should do about this? Googling parts of the given code returns tens of thousands of sites with this code present.

share|improve this question
I'm guessing that this code is meant to be somehow injected into CMS fields. In the bottom of the first page of the Google search, has had this code injected into their page titles, but they properly escaped the HTML elements, so the code shows up verbatim in the page titles. If your friend sent his mail by a webmail interface, it's possible that some type of malware mistook the Subject field for a CMS page-title field and injected the code. – apsillers Jan 7 '13 at 17:36
up vote 8 down vote accepted

I think the confusion lies in some incorrect text encoding.

With proper encoding the (contents) decodes to Russian:


Which can be Google translated to the English:


So it appears to be some form of SEO Spam. However, how it got to the end of the subject line of your friend's email is not clear, though I would hazard a guess that it was inserted by some malware.

You should inform your friend that they are potentially infected by malware.

share|improve this answer
+1 excellent analysis – RTOSkit Jan 7 '13 at 18:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.