[Mr.Kurd]

In The Name OF Allah
Al-Salam Alekum

Hi guys, I found this behind my AP, I think its XSS, Where it came?? I don't know.
Note: xxxxxxxxx.xxx is my website url.

Code:

FixUrl.onDataFetch('<div id="goog-wm"><div class="content"><h3 class="other-things"><b>Other things to try:</b></h3><ul><li class="search-goog"><script type="text/javascript">function ss(form) {var q = window.encodeURIComponent(form["q"].value);clkb("wss", q);var url = "http://www.google.com/search?q=site:https://xxxxxxxxx.xxx ";url = url + q;window.location = url;return false;}\x3c/script> Search <b>https://xxxxxxxxx.xxx</b>:<form onsubmit="return ss(this)" method=get><input type=text size=40 name=q id="goog-wm-qt" value="ilovekurdy"><input type=submit value="Google Search" id="goog-wm-sb"></form></li></ul></div></div><script type="text/javascript">function clk(el,ct,cd) {if(document.images) {(new Image()).src="http://linkhelp.clients.google.com/tbproxy/lh/url?sa=T" +"&q="+"https://xxxxxxxxx.xxx/cc/ilovekurdy" +"&usg=" + "AFQjCNFHRVgs7ukH3M7zJ4hXsTld_GWb-g" +"&ct=" + ct +"&cd=" + cd +"&fp=3321724020990354902" +"&ei=fXneWcKBOpHqU_KVgZgF" +"&url="+escape(el.href)+"&hl=en" +"&sourceid=wm" +"&error=http404" +"&pref=" +"&cr=ZZ" +"&d=" + (new Date()).getTime() +"&xi=";}return true;}\x3c/script><script>function rwrd(el, lnk){el.href= lnk;el.onmousedown="";return true;}\x3c/script><script>function rwctrd(el,ct,cd,lnk){clk(el, ct, cd);rwrd(el, lnk);}\x3c/script><script>function clkb(ct,sq) {if(document.images) {(new Image()).src="http://linkhelp.clients.google.com/tbproxy/lh/url?sa=T" +"&q="+"https://xxxxxxxxx.xxx/cc/ilovekurdy" +"&usg=" + "AFQjCNFHRVgs7ukH3M7zJ4hXsTld_GWb-g" +"&ct=" + ct +"&cd=0&sq=" + sq +"&fp=3321724020990354902" +"&ei=fXneWcKBOpHqU_KVgZgF" +"&hl=en" +"&sourceid=wm" +"&error=http404" +"&pref=" +"&cr=ZZ" +"&d=" + (new Date()).getTime() +"&xi=";}}\x3c/script>');

Wa Salam Alekum

[Ecks]

Not 100% sure but it appears to be R, but Syntax highlighting from CSS does fit it as well.

[Mr.Kurd]

Not 100% sure but it appears to be R, but Syntax highlighting from CSS does fit it as well.

It was behind my Admin Panel and my Browser blocked it.
it could be something for stealing or spying, not sure.

[Altair]

It's javascript bro, probably frontend code. Also, it seems like something like search form with a redirect, nothing harmful, maybe it caused by your browser or something like AdBlocker etc.
If you didn't face with that again, go ahead with it, its okay

[Mr.Kurd]

It's javascript bro, probably frontend code. Also, it seems like something like search form with a redirect, nothing harmful, maybe it caused by your browser or something like AdBlocker etc.
If you didn't face with that again, go ahead with it, its okay

I got it two times.
Thank you, actually I worried.

[Altair]

It's javascript bro, probably frontend code. Also, it seems like something like search form with a redirect, nothing harmful, maybe it caused by your browser or something like AdBlocker etc.
If you didn't face with that again,  go ahead with it, its okay

I got it two times.
Thank you, actually I worried.

If you want I can take a look as far as I understand when some time

[Mr.Kurd]

It's javascript bro, probably frontend code. Also, it seems like something like search form with a redirect, nothing harmful, maybe it caused by your browser or something like AdBlocker etc.
If you didn't face with that again,  go ahead with it, its okay

I got it two times.
Thank you, actually I worried.

If you want I can take a look as far as I understand when some time

it's not showing now because I reset my script files again.
but sure IF I got it again, I will contact you bro.