5 added syntax highlighting
source | link
<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>
<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>
<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>
<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...
<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>
<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...
<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>
<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...
4 Copy edited. Reformatted the sample code for readibility (whitespace).
source | link

First, adzerk is loaded in the stackoverflowStack Overflow page through a script tag in the <div id="sidebar">. Indeed all of this action takes place in the sidebar.

<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() { 
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ; 
    });
</script>
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* forFor IEInternet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* forFor webkitWebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* forFor firefoxFirefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';
 

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>

It starts to go downhill from here, as a host of scripts are loaded. Inside of that block you can see the call to doubleverifydoubleverify. You can see a call to atdmtatdmt. And what isn't initially obvious is the nested calls which exist in the next iframe. A slough of scripts are loaded after this. For example:

And a genuine offer for a free trial of windows azureWindows Azure. I understand some people may not trust microsoftMicrosoft, but I would doubt they would place anything malicious in their ads and have not seen any negative affects of the errors or visiting the link.

First, adzerk is loaded in the stackoverflow page through a script tag in the <div id="sidebar">. Indeed all of this action takes place in the sidebar.

<script>
var ados = ados || {};ados.run = ados.run || [];
ados.run.push(function() { 
 ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ; 
});
</script>
<script>
new function() {
this.rand = Math.floor((Math.random() + "") * 1000000000000);
this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
this.dvregion = '0';
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
<scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
</scr'+'ipt></iframe>';
this.altsrc = '<style>\
.container {\
    border: 1px solid #3b599e;\
    overflow: hidden;\
    filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* for IE */\
    background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* for webkit browsers */\
    background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* for firefox 3.6+ */ \
}\
.cloud {\
    color: #fff;\
    position: relative;\
    font: 100% "Times New Roman", Times, serif;\
    text-shadow: 0px 0px 10px #fff;\
    line-height: 0;\
}\
</style>\
<scr'+'ipt type="text/javascr'+'ipt">\
function cloud(){\
var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
var b2 = "px; position: absolute; top: ";\
document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
}\
function clouds(){\
var top = [\'-80\',\'80\',\'240\',\'400\'];\
var left = -10;\
var a1 = "<div style=\\"position: relative; top: ";\
var a2 = "px; left: ";\
var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
for(i=0; i<8; i++)\
{\
document.write(a1+top[0]+a2+left+a3);\
document.write(a1+top[1]+a2+left+a3);\
document.write(a1+top[2]+a2+left+a3);\
document.write(a1+top[3]+a2+left+a3); \
if(i==4)\
{\
left = -90;\
top = [\'0\',\'160\',\'320\',\'480\'];\
}\
else left += 160;\
}\
}\
</scr'+'ipt>\
<div class="container" style="width: 220px; height: 250px;">\
<scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
</div>';
 

this.callbackName = '__dvredirect_callback_' + this.rand;
var thisRedirect = this;
window[this.callbackName] = function () { return thisRedirect; };

var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
}
</script>

It starts to go downhill from here, as a host of scripts are loaded. Inside of that block you can see the call to doubleverify. You can see a call to atdmt. And what isn't initially obvious is the nested calls which exist in the next iframe. A slough of scripts are loaded after this. For example:

And a genuine offer for a free trial of windows azure. I understand some people may not trust microsoft, but I would doubt they would place anything malicious in their ads and have not seen any negative affects of the errors or visiting the link.

First, adzerk is loaded in the Stack Overflow page through a script tag in the <div id="sidebar">. Indeed all of this action takes place in the sidebar.

<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>
<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>

It starts to go downhill from here, as a host of scripts are loaded. Inside of that block you can see the call to doubleverify. You can see a call to atdmt. And what isn't initially obvious is the nested calls which exist in the next iframe. A slough of scripts are loaded after this. For example:

And a genuine offer for a free trial of Windows Azure. I understand some people may not trust Microsoft, but I would doubt they would place anything malicious in their ads and have not seen any negative affects of the errors or visiting the link.

3 added 29 characters in body
source | link
<script>
new function() {
this.rand = Math.floor((Math.random() + "") * 1000000000000);
this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
this.dvregion = '0';
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
<scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
</scr'+'ipt></iframe>';
this.altsrc = '<style>\
.container {\
    border: 1px solid #3b599e;\
    overflow: hidden;\
    filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* for IE */\
    background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* for webkit browsers */\
    background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* for firefox 3.6+ */ \
}\
.cloud {\
    color: #fff;\
    position: relative;\
    font: 100% "Times New Roman", Times, serif;\
    text-shadow: 0px 0px 10px #fff;\
    line-height: 0;\
}\
</style>\
<scr'+'ipt type="text/javascr'+'ipt">\
function cloud(){\
var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
var b2 = "px; position: absolute; top: ";\
document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
}\
function clouds(){\
var top = [\'-80\',\'80\',\'240\',\'400\'];\
var left = -10;\
var a1 = "<div style=\\"position: relative; top: ";\
var a2 = "px; left: ";\
var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
for(i=0; i<8; i++)\
{\
document.write(a1+top[0]+a2+left+a3);\
document.write(a1+top[1]+a2+left+a3);\
document.write(a1+top[2]+a2+left+a3);\
document.write(a1+top[3]+a2+left+a3); \
if(i==4)\
{\
left = -90;\
top = [\'0\',\'160\',\'320\',\'480\'];\
}\
else left += 160;\
}\
}\
</scr'+'ipt>\
<div class="container" style="width: 220px; height: 250px;">\
<scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
</div>';


this.callbackName = '__dvredirect_callback_' + this.rand;
var thisRedirect = this;
window[this.callbackName] = function () { return thisRedirect; };

var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
}
</script>
new function() {
this.rand = Math.floor((Math.random() + "") * 1000000000000);
this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
this.dvregion = '0';
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
<scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
</scr'+'ipt></iframe>';
this.altsrc = '<style>\
.container {\
    border: 1px solid #3b599e;\
    overflow: hidden;\
    filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* for IE */\
    background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* for webkit browsers */\
    background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* for firefox 3.6+ */ \
}\
.cloud {\
    color: #fff;\
    position: relative;\
    font: 100% "Times New Roman", Times, serif;\
    text-shadow: 0px 0px 10px #fff;\
    line-height: 0;\
}\
</style>\
<scr'+'ipt type="text/javascr'+'ipt">\
function cloud(){\
var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
var b2 = "px; position: absolute; top: ";\
document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
}\
function clouds(){\
var top = [\'-80\',\'80\',\'240\',\'400\'];\
var left = -10;\
var a1 = "<div style=\\"position: relative; top: ";\
var a2 = "px; left: ";\
var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
for(i=0; i<8; i++)\
{\
document.write(a1+top[0]+a2+left+a3);\
document.write(a1+top[1]+a2+left+a3);\
document.write(a1+top[2]+a2+left+a3);\
document.write(a1+top[3]+a2+left+a3); \
if(i==4)\
{\
left = -90;\
top = [\'0\',\'160\',\'320\',\'480\'];\
}\
else left += 160;\
}\
}\
</scr'+'ipt>\
<div class="container" style="width: 220px; height: 250px;">\
<scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
</div>';


this.callbackName = '__dvredirect_callback_' + this.rand;
var thisRedirect = this;
window[this.callbackName] = function () { return thisRedirect; };

var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
}
<script>
new function() {
this.rand = Math.floor((Math.random() + "") * 1000000000000);
this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
this.dvregion = '0';
this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
<scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
</scr'+'ipt></iframe>';
this.altsrc = '<style>\
.container {\
    border: 1px solid #3b599e;\
    overflow: hidden;\
    filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* for IE */\
    background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* for webkit browsers */\
    background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* for firefox 3.6+ */ \
}\
.cloud {\
    color: #fff;\
    position: relative;\
    font: 100% "Times New Roman", Times, serif;\
    text-shadow: 0px 0px 10px #fff;\
    line-height: 0;\
}\
</style>\
<scr'+'ipt type="text/javascr'+'ipt">\
function cloud(){\
var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
var b2 = "px; position: absolute; top: ";\
document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
}\
function clouds(){\
var top = [\'-80\',\'80\',\'240\',\'400\'];\
var left = -10;\
var a1 = "<div style=\\"position: relative; top: ";\
var a2 = "px; left: ";\
var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
for(i=0; i<8; i++)\
{\
document.write(a1+top[0]+a2+left+a3);\
document.write(a1+top[1]+a2+left+a3);\
document.write(a1+top[2]+a2+left+a3);\
document.write(a1+top[3]+a2+left+a3); \
if(i==4)\
{\
left = -90;\
top = [\'0\',\'160\',\'320\',\'480\'];\
}\
else left += 160;\
}\
}\
</scr'+'ipt>\
<div class="container" style="width: 220px; height: 250px;">\
<scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
</div>';


this.callbackName = '__dvredirect_callback_' + this.rand;
var thisRedirect = this;
window[this.callbackName] = function () { return thisRedirect; };

var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
}
</script>
2 added 465 characters in body
source | link
1
source | link