Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
Pages: 1
#1 2007-04-05 20:32:11
- els
- Moderator
- From: The Netherlands
- Registered: 2004-06-06
- Posts: 7,458
Strange .js files in my stats
I assume this won’t be exactly Textpattern related, so feel free to move this post elsewhere.
Yesterday I found in the stats (Slimstat) of one of my sites a couple of strange URLs to .js files as a part of my own visit:
When I followed the link to the first URL, /textpattern/nsijx.js, I actually saw a javascript file in my browser. When I checked using FireFTP, of course there were no such .js files there. But after that first view, all I got when following the links were 404’s. Of course. And of course I did not think of copying the javascript the first time I saw it, and it had also disappeared from the cache…
It was only during that one visit, it has not occurred since then. I can’t check if it also happened with other sites because only on this site Slimstat is – accidentally – recording my own visits.
I’d like to know if this is something to worry about?
Offline
Re: Strange .js files in my stats
javascript files can’t make themselves disappear, as far as I know.
Between the time that you saw the javascript file and the time that you could no longer see it on the server, are there any suspicious log entries for other pages that shouldn’t be on your website?
Offline
#3 2007-04-05 22:52:54
- els
- Moderator
- From: The Netherlands
- Registered: 2004-06-06
- Posts: 7,458
Re: Strange .js files in my stats
No, I can’t see any. That was a very short time anyway. I’ve been searching my access logs and found a few earlier entries:
84.24.202.97 – - [02/Apr/2007:13:00:05 -0400] “GET /textpattern/zrbaf.js HTTP/1.1” 404 1009 “http://casadonamaria.nl/textpattern/index.php?event=link&step=link_edit&id=5&sort=&dir=asc&page=1&search_method=&crit=” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11”
…
159.46.248.234 – - [03/Apr/2007:03:08:10 -0400] “GET /xjpzz.js HTTP/1.0” 404 997 “http://www.casadonamaria.nl/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
…
159.46.248.98 – - [03/Apr/2007:03:08:32 -0400] “GET /nl-start/pchoj.js HTTP/1.0” 404 997 “http://www.casadonamaria.nl/nl-start/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
…
84.24.202.97 – - [03/Apr/2007:05:43:09 -0400] “GET /dknbr.js HTTP/1.1” 404 1009 “http://www.casadonamaria.nl/” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11”
…
84.24.202.97 – - [04/Apr/2007:11:46:20 -0400] “GET /tfpyi.js HTTP/1.1” 404 1009 “http://www.casadonamaria.nl/” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11”
…
84.24.202.97 – - [04/Apr/2007:13:13:09 -0400] “GET /textpattern/nsijx.js HTTP/1.1” 404 1009 “http://casadonamaria.nl/textpattern/index.php” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11”
The last one is the first one on the screenshot above. 84.24.202.97 is my ip. Later entries all show my ip and a referring slimstat page, so those must be the links I followed from there. My entries on 2 and 3 April show 404, but I have seen no 404’s during my visits then.
(I only moved the site to this new server on April 2nd.)
Offline
#4 2007-04-05 23:26:25
- zem
- Developer Emeritus
- From: Melbourne, Australia
- Registered: 2004-04-08
- Posts: 2,579
Re: Strange .js files in my stats
All are 404 responses.
Is www.casadonamaria.nl the site in question, or a different one?
The first time I loaded the front page of that site, the HTML source included a <script> tag with a similar random name just after the <body> tag. It disappeared on subsequent reloads.
If that is your site, it’s possible this is caused by a plugin, or by some PHP code in the page template.
Does your diagnostics show any modified Textpattern files?
Alex
Offline
#5 2007-04-05 23:36:59
- els
- Moderator
- From: The Netherlands
- Registered: 2004-06-06
- Posts: 7,458
Re: Strange .js files in my stats
zem wrote:
Is www.casadonamaria.nl the site in question, or a different one?
That is the site in question.
If that is your site, it’s possible this is caused by a plugin, or by some PHP code in the page template.
Does your diagnostics show any modified Textpattern files?
No they don’t. I just found that two other sites on the same server show similar URLs in the stats, and those are not my own visits.
I’ll start with disabling plugins and checking php code. Otherwise, could it be a server problem?
Offline
#6 2007-04-06 02:51:22
- zem
- Developer Emeritus
- From: Melbourne, Australia
- Registered: 2004-04-08
- Posts: 2,579
Re: Strange .js files in my stats
It looks like something is deliberately inserting those script tags into your HTML output. It could be a server-wide thing. Perhaps some kind of stats or tracking app.
Last edited by zem (2007-04-06 02:51:52)
Alex
Offline
#7 2007-04-06 17:01:13
- els
- Moderator
- From: The Netherlands
- Registered: 2004-06-06
- Posts: 7,458
Re: Strange .js files in my stats
Thank you, I have contacted the host.
Offline
Pages: 1