Infinitely Meta » cryptic http://blog.infinitelymeta.com The possibilities are endless. Fri, 10 Sep 2010 07:11:56 +0000 en hourly 1 http://wordpress.org/?v=3.2 Name squatting and cryptic javascript blocks http://blog.infinitelymeta.com/2008/06/name-squatting-and-cryptic-javascript-blocks/ http://blog.infinitelymeta.com/2008/06/name-squatting-and-cryptic-javascript-blocks/#comments Fri, 27 Jun 2008 16:43:35 +0000 Brian Daniel Eisenberg http://blog.infinitelymeta.com/?p=13 As you can probably tell, I recently switched from my old Blogger-hosted blog to this nice clean, self-hosted WordPress blog. While I was doing some cleanup on Blogger a couple weeks ago, I noticed that my old blog URI was now redirecting to some strange new page/blog after I had previously changed the root prefix from "bdeseattle" to "infinitelymeta".

Now, when I go to http://bdeseattle.blogspot.com, I get someone else's page with an odd post about Cameras. If you view the source of this page, there is some very interesting meta buried in the code.

From the source code, I'm able to see that the userID who claimed the blog URI is: braeden

Towards the bottom of the source, I also see the following script block, which appears to be a for loop with some very cryptic variable names.

Interestingly cryptic javascript code snippet

I'm not so concerned about the name squatting thing, as I did abandon my old blog URI, but it just seems a bit odd that someone else snapped up my blog URI and put this page up in its place. Here's another site that is referenced by some of the script blocks in the source: http://oedemera.com/

A quick traceroute and whois reveals the following information:

OrgName:    HopOne Internet Corporation
OrgID:      HOPO
Address:    3311 South 120th Place
City:       Tukwila
StateProv:  WA
PostalCode: 98168-5125
Country:    US

ReferralServer: rwhois://rwhois.hopone.net:4321

NetRange:   209.160.0.0 - 209.160.79.255
CIDR:       209.160.0.0/18, 209.160.64.0/20
NetName:    HOPONE-MULTI-SITE-1
NetHandle:  NET-209-160-0-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.HOPONE.NET
NameServer: NS5.HOPONE.NET
NameServer: NS3.HOPONE.NET
NameServer: NS2.HOPONE.NET
NameServer: NS6.HOPONE.NET
NameServer: NS4.HOPONE.NET
Comment:    HopOne Internet Corp.(R)
Comment:    The Foundation of Internet Success.(R)
RegDate:    2004-02-04
Updated:    2007-05-08

OrgAbuseHandle: ABUSE958-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  206-438-5909
OrgAbuseEmail:  abuse@hopone.net

OrgTechHandle: HJ48-ARIN
OrgTechName:   Jass, Haralds
OrgTechPhone:  +1-206-438-5909
OrgTechEmail:  hjass@hopone.net

Should I be concerned?

]]> http://blog.infinitelymeta.com/2008/06/name-squatting-and-cryptic-javascript-blocks/feed/ 0