3

I am not sure if this is the right place to ask this question, however I can't think of any other place where I can find answer to this.

I have noticed, this weird iframe on bottom of quite a few website. Weird because all of them same ip address. Here is screenshot from stackoverflow and bundler.io:

enter image description here enter image description here

It may sound far fetched but could it be possible that someone is listening on me? I am just concerned. I am using chrome: 41.0.2272.118 (64-bit) and my os is ubuntu 14.04

I am talking about this:

   <iframe id="fn_layer8" src="http://223.224.131.144:80/l8/Layer8Servlet" target="_blank" frameborder="no" style="display: block !important; opacity: 0 !important; z-index: 2147483646 !important;">
    #document
    <html>
      <head>
        <style type="text/css"></style>
      </head>
      <body>
       <pre style="word-wrap: break-word; white-space: pre-wrap;"></pre>
      </body>
     </html>
    </iframe>
<div id="fnscreenOverlay" style="position: fixed !important; bottom: 0px !important; left: 0px !important; top: auto !important; right: auto !important; height: 2571px !important; z-index: 2147483645 !important; width: 100% !important; text-align: center !important; margin: 0px !important; padding: 0px !important; border: 0px !important; opacity: 0 !important; display: none !important; background-color: transparent !important;"></div>
  • Does this happen if you use a proxy or vpn and/or change your DNS provider? Are you using a provider in the part of the world known to insert stuff like this? I inlined the screenshots under the impression the original question at SO could be deleted if it needed to be. – Ramhound May 21 '15 at 14:02
  • 223.224.131.144 is India Delhi Bharti Airtel Ltd. Is this your ISP? – DavidPostill May 21 '15 at 14:45
  • Yes, I use airtel for browsing. I was suspecting that airtel is doing this too, I check if I have same thing in windows (on dual boot) and I do, I have it on my android browser too if I request desktop site. I changed my service provider and all of it was gone (after deleting chache). Should I report this? Why are they doing this? – sonalkr132 May 21 '15 at 15:22
  • What's with these stupid ISPs? 1, 2, 3 ... – Karan May 21 '15 at 19:15
4
<iframe id="fn_layer8" src="http://223.224.131.144:80/l8/Layer8Servlet" target="_blank" frameborder="no" style="display: block !important; opacity: 0 !important; z-index: 2147483646 !important;">

Layer8 press release

Layer8 creates new operator-owned advertising real-estate for more revenue-generating opportunities [...]

Flash Networks [...] is proud to count among its customers top-tier mobile carriers including Bharti Airte [...]

So what you have is an ISP injecting advertising code on the server side. I note that the iframe div is set to transparent, so they are trying to show ads without you seeing them.

Why? Revenue.

Since ads are one of the primary virus vectors, it is not only shady practice, it is actively dangerous to users. (google: malvertising)

| improve this answer | |
  • Thanks Yorik! Guess what else? Airtel also closes connection from remote server if it has been idle for a while, which happens quite often when I am pushing code to some slow distant server. It already took me weeks to figure that out and now this -_- – sonalkr132 May 21 '15 at 16:12
0

I think you might have a malware infection (as uncommon as that is on Linux). I would scan with an anti-malware/anti-virus program. The Ubuntu documentation has information about Anti-Virus software in Ubuntu.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.