5

A friend of mine received an email from someone (a reputable sender), and I noticed that the following was tagged onto the end of the subject:

</title><style>.axhg{position:absolute;clip:rect(484px,auto,auto,484px);}</style><div class=axhg><a href=(site) > (contents)

where

(site) = 116jurist(dot)ru
(contents) = þðèäè÷åñêèå-êîíñóëüòàöè

My question has two parts:

  1. Do the given contents mean anything? It looks like its encoded for XSS filter evasion, but I don't know what kind of encoding it could be. The contents may only be partial (may have been cut short in the subject line).

  2. Is there something that I can/should do about this? Googling parts of the given code returns tens of thousands of sites with this code present.

|improve this question
  • 1
    I'm guessing that this code is meant to be somehow injected into CMS fields. In the bottom of the first page of the Google search, www.arcum.ch has had this code injected into their page titles, but they properly escaped the HTML elements, so the code shows up verbatim in the page titles. If your friend sent his mail by a webmail interface, it's possible that some type of malware mistook the Subject field for a CMS page-title field and injected the code. – apsillers Jan 7 '13 at 17:36
8

I think the confusion lies in some incorrect text encoding.

With proper encoding the (contents) decodes to Russian:

юридические-консультаци

Which can be Google translated to the English:

legal-consulting

So it appears to be some form of SEO Spam. However, how it got to the end of the subject line of your friend's email is not clear, though I would hazard a guess that it was inserted by some malware.

You should inform your friend that they are potentially infected by malware.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.