A suspicious url was being blocked by web filtering software. Referrer was datasheetz.com.
I looked at the code of datasheetz.com. At a first glance there was nothing suspicious to find.
It took me some time to figure out where the suspicious url came from.
Look at the final script statement at the end of the page code.
Line
<script src="www.google-analytics.com/urchin.js" type="text/javascript"></script>looks unsuspiciously, because it looks like a normal Google Analytics requests. But it's the key.
The url is missing the http:// statement. That means that the url is relative to the current url - actually
hxxp://datasheetz.com/www.google-analytics.com/urchin.js
There you can find the code creating the supicious url.
I don't get any content from that url. Please let me know if you get something. Url changes occasionally.
Topic: Nice trick on datasheetz.com (Read 10402 times)