15

While searching on Google I found a website that shows one set of content to the Google Bot and an other to users (by redirecting to a new domain), and also a very suspicious Javascript file. Maybe it's a tracking cookie or a virus/malware, I don't know, so I am asking here if someone can help explain the code?

If the site is "safe" why does it redirect a search engine to a normal website, and users to a blank page by loading this .js file? Why should it have a getpassword.asp hosted on the second redirected domain (from sucuri scan) ?

document.write ('<a href="" target="_blank"><img alt="&#x35;&#x31;&#x2E;&#x6C;&#x61;&#x20;&#x4E13;&#x4E1A;&#x3001;&#x514D;&#x8D39;&#x3001;&#x5F3A;&#x5065;&#x7684;&#x8BBF;&#x95EE;&#x7EDF;&#x8BA1;" src="" style="" /></a>\n');
var a1156tf="51la";var a1156pu="";var a1156pf="51la";var a1156su=window.location;var a1156sf=document.referrer;var a1156of="";var a1156op="";var a1156ops=1;var a1156ot=1;var a1156d=new Date();var a1156color="";if (navigator.appName=="Netscape"){a1156color=screen.pixelDepth;} else {a1156color=screen.colorDepth;}
try{a1156tf=top.document.referrer;}catch(e){}
try{a1156pu =window.parent.location;}catch(e){}
try{a1156pf=window.parent.document.referrer;}catch(e){}
try{a1156ops=document.cookie.match(new RegExp("(^| )a1156_pages=([^;]*)(;|$)"));a1156ops=(a1156ops==null)?1: (parseInt(unescape((a1156ops)[2]))+1);var a1156oe =new Date();a1156oe.setTime(a1156oe.getTime()+60*60*1000);document.cookie="a1156_pages="+a1156ops+ ";path=/;expires="+a1156oe.toGMTString();a1156ot=document.cookie.match(new RegExp("(^| )a1156_times=([^;]*)(;|$)"));if(a1156ot==null){a1156ot=1;}else{a1156ot=parseInt(unescape((a1156ot)[2])); a1156ot=(a1156ops==1)?(a1156ot+1):(a1156ot);}a1156oe.setTime(a1156oe.getTime()+365*24*60*60*1000);document.cookie="a1156_times="+a1156ot+";path=/;expires="+a1156oe.toGMTString();}catch(e){}
try{if(document.cookie==""){a1156ops=-1;a1156ot=-1;}}catch(e){}
a1156of=a1156sf;if(a1156pf!=="51la"){a1156of=a1156pf;}if(a1156tf!=="51la"){a1156of=a1156tf;}a1156op=a1156pu;try{lainframe}catch(e){a1156op=a1156su;}
a1156src='(0-a1156d.getTimezoneOffset()/60)+'&tcolor='+a1156color+'&sSize='+screen.width+','+screen.height+'&referrer='+escape(a1156of)+'&vpage='+escape(a1156op)+'&vvtime='+a1156d.getTime();
setTimeout('a1156img = new Image;a1156img.src=a1156src;',0);

migrated from programmers.stackexchange.com Sep 4 '14 at 10:25

This question came from our site for professionals, academics, and students working within the systems development life cycle.

  • If this sort of thing bothers you, use a browser plugin or extension that blocks third-party tracking websites. You'll deprive the website of revenue though. – Snowbody Sep 5 '14 at 15:59
41

Let's clean this up and look at it more closely, I've also replaced some HTML entities with their text equivalent:

Add a linked image to the page, Chinese characters were encoded but I don't think this is suspicious:

document.write('<a href="http://www.51.la/?17211156" target="_blank"><img alt="51.la 专业、免费、强健的访问统计" src="http://icon.ajiang.net/icon_8.gif" style="border:none" /></a>\n');

Initialize a bunch of variables, mostly with attributes about the browser and page, such as the HTTP referrer and the current URL, date, browser resolution, etc.

var a1156tf = "51la";
var a1156pu = "";
var a1156pf = "51la";
var a1156su = window.location;
var a1156sf = document.referrer;
var a1156of = "";
var a1156op = "";
var a1156ops = 1;
var a1156ot = 1;
var a1156d = new Date();
var a1156color = "";
if (navigator.appName == "Netscape") {
    a1156color = screen.pixelDepth;
} else {
    a1156color = screen.colorDepth;
}
try {
    a1156tf = top.document.referrer;
} catch (e) {}
try {
    a1156pu = window.parent.location;
} catch (e) {}
try {
    a1156pf = window.parent.document.referrer;
} catch (e) {}
try {

Appears to be looking for any existing cookies set by this application in order to keep a count of how many pages have been visited. This value is incremented and stored in a cookie.

    a1156ops = document.cookie.match(new RegExp("(^| )a1156_pages=([^;]*)(;|$)"));
    a1156ops = (a1156ops == null) ? 1 : (parseInt(unescape((a1156ops)[2])) + 1);
    var a1156oe = new Date();
    a1156oe.setTime(a1156oe.getTime() + 60 * 60 * 1000);
    document.cookie = "a1156_pages=" + a1156ops + ";path=/;expires=" + a1156oe.toGMTString();

It basically seems to be trying to record how many distinct pages you've viewed. Again it uses a cookie to help remember if you've already visited.

    a1156ot = document.cookie.match(new RegExp("(^| )a1156_times=([^;]*)(;|$)"));
    if (a1156ot == null) {
        a1156ot = 1;
    } else {
        a1156ot = parseInt(unescape((a1156ot)[2]));
        a1156ot = (a1156ops == 1) ? (a1156ot + 1) : (a1156ot);
    }
    a1156oe.setTime(a1156oe.getTime() + 365 * 24 * 60 * 60 * 1000);
    document.cookie = "a1156_times=" + a1156ot + ";path=/;expires=" + a1156oe.toGMTString();

Miscellaneous stuff, probably just to cater to differing browser capabilities and settings, such as cookies being disabled.

} catch (e) {}
try {
    if (document.cookie == "") {
        a1156ops = -1;
        a1156ot = -1;
    }
} catch (e) {}
a1156of = a1156sf;
if (a1156pf !== "51la") {
    a1156of = a1156pf;
}
if (a1156tf !== "51la") {
    a1156of = a1156tf;
}
a1156op = a1156pu;
try {
    lainframe
} catch (e) {
    a1156op = a1156su;
}

Write all this information as GET parameters in the source attribute of an image. Your browser will load this then their server can record the data.

a1156src = 'http://web.51.la:82/go.asp?svid=8&id=17211156&tpages=' + a1156ops + '&ttimes=' + a1156ot + '&tzone=' + (0 - a1156d.getTimezoneOffset() / 60) + '&tcolor=' + a1156color + '&sSize=' + screen.width + ',' + screen.height + '&referrer=' + escape(a1156of) + '&vpage=' + escape(a1156op) + '&vvtime=' + a1156d.getTime();
setTimeout('a1156img = new Image;a1156img.src=a1156src;', 0);

Basically it's tracking you, including the page you're viewing, how many times you've viewed the site, how many pages you've viewed, what your browser resolution is, etc.

This could be malicious depending on the circumstances, although most websites run tracking of some form such as Google Analytics. It doesn't pose a threat to the integrity of your machine as someone viewing the site, but it might be a threat to your privacy.

The odd variable names do make it seem like obfuscated malware, but I suspect this is to avoid variable naming conflicts with other JavaScript.

  • 15
    This is a Google Analytics competitor called "51.la". The site tracked here is "promgirl.de". On the Chinese version of this site, they're probably having the same discussion about the suspicious-looking "i,s,o,g,r,a,m" tracking system. :) – bzlm Sep 4 '14 at 18:21
  • 4
    Note that although this script is itself harmless, 51.la trackers are very often used in Chinese malware exploits. If seen on a site not otherwise connected to China I would take the presence of a 51 script as a red flag for likely compromise. – bobince Sep 5 '14 at 14:24
12

No, it doesn't look like a virus, but definitely like an attempt to track your visits across different sites.

Basically, it collects a bunch of information about your browser, some cookies and which page you've come from, and puts all these as parameters into the URL of an image it loads from a server. That server can then aggregate this information from your visits to this and other sites with the same code into a user profile, which will probably be used to show you targeted advertising.

0

So this showed up on a site that I had built for somebody. Here is what I can see symptomatically (I am not a programmer).

This software is installed on sites specifically to redirect the google spider bot to pick up a ton of content that is not actually on the targeted site. When in play, you will see the traffic to the website increase significantly, but there are no actual benefits to be seen. What these guys are doing is telling google that there is way more content on a website than actually is. When someone clicks on one of these fake links from a google search, they are redirected to a page that sells goods on legitimate sites.

What is happening is that these guys are affiliates of the sites that are selling the goods and they are getting commissions from each on-line sale.

They are parasites who exploit thousands of other peoples' sites to make money for themselves.

-5

I was faced with the same alerts in our environment, so I was curious what is generating this traffic. When you think about it, there needs to be some malware installed in your browser as a plugin or similar, because I can clearly see Google search results with this URL.

Example:

web.51.la:82/go.asp?svid=8&id=15942596&tpages=1&ttimes=1&tzone=8&tcolor=24&sSize=1440,900&referrer=https://www.google.de/&vpage=http://www.qupingche.com/comment/show/103&vvtime=1409818963602

When you go to the page http://www.qupingche.com/comment/show/103, it's a Chinese website that I'm 100% sure you didn't visit. On its page, you can see the web51.la stuff in this script:

<script language="javascript" type="text/javascript" src="http://js.users.51.la/15942596.js">
</script>

And when you check the variable of the JavaScript, it's incrementing requested location by one every 10 seconds.

This is what I saw:

js.users.51.la/15942596.js

And this is the latest one with the same content:

js.users.51.la/15994950.js

So when you see this request from your client, then there needs to be some malware generating this request on your computer!

  • 1
    As mentioned in the answers below, this script provides a tracking mechanism for website owners. It does not rely on a plugin installed by users. It appears to be innocent, though possibly a threat to privacy - in exactly the same way Google Analytics is. – Chris Murray Sep 5 '14 at 8:54
  • 3
    Why would you be 100% sure about what sites other people have visited? – TRiG Sep 5 '14 at 13:17
  • 1
    There's absolutely no need for something on the client end to generate these unique requests. I also see no evidence that that's taking place. Perpetrators could have set up a web server that takes any .js request (or one where filename is a number, relatively easy to do with, say, RewriteCond and RegEx on Apache) and redirects to a single file on the server. With the unique name generated on the server side for each request so it can't be simply blocked by its name, to serve as a simple counter, request obfuscation, tracking, load balancing, or any other reason they might have had. – TildalWave Sep 5 '14 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.