Last month, I noticed a bunch of CSP enforcement block actions against https://vacceedpasian.com/conversion.js, and I'm curious if anyone knows what this is.
We have implemented Content Security Policy intended to prevent arbitrary, uknown, or unauthorized scripts from running, and I frequently see block actions for things like the well-known JavaScript injected by in-app browsers (e.g. https://connect.facebook.net/en_US/pcm.js). I also generally see a bit of "noise" that I will investigate on a case-by-case basis. About a month ago, I started noticing an increasing number of enforcement block actions against https://vacceedpasian.com/conversion.js. It's now risen well above the "noise floor", so it's important to me to know where it's coming from in the interest of our users' privacy and security.
So far, I have been unable to determine much. I haven't seen any traffic or articles about it anywhere that I monitor for threat intelligence. By virtue of it's name, I would GUESS it's injected by any of several browser extensions that serve ads and/or track user behavior, but I'd like to know.
Here are a few things I do know:
They appear to be coming from Chrome browsers running on both Windows and macOS. I haven't seen reports from other browsers or operating systems so far.
The domain "vacceedpasian.com" was registered, privately, through Key-Systems GmbH on July 12 - so it's a relatively new domain, and whois won't be able to show who registered it.
Tracing the route to https://vacceedpasian.com shows it being hosted (or at least gatewayed) by Amazon CloudFront and EC2, in Ashburn and Boardman.
When I attempt to download the JavaScript file itself, I get a 400 error from nginx/cloudfront, which is unfortunate, but neither surprising nor meaningful to me.
That's about it, at this point.
Anyone know what this one is? Any suggestions where else I could look for privacy "threat" intelligence on the topic of sources of injected JavaScript other than XSS?
