We have a client that does business with this company and recently we noticed our Barracuda blocking their e-mails based on Intent Analysis. Further investigation showed that it was because of a URL embedded on their home page. (Their home page is linked in their signature.) I couldn't find the URL anywhere on the site, so I inspected the HTML code. This is what I found.
- This code was appended to the end of the html file.
- It's not google ads, it's a static hyperlink.
To me, this looks like a persistent XSS attack. Maybe a ploy to generate Ad Revenue? I'm thinking the string fun is to avoid pattern detection.
I sent it to their IT department. (Not sure if they will be able to fix this.)
Any insights on this?
EDIT: Found some more scripting at the beginning of the file. This actually changed the title of the domain in search engines.