Iframe on bottom of every page

I am not sure if this is the right place to ask this question, however I can't think of any other place where I can find answer to this.

I have noticed, this weird iframe on bottom of quite a few website. Weird because all of them same ip address. Here is screenshot from stackoverflow and bundler.io:

enter image description here

It may sound far fetched but could it be possible that someone is listening on me? I am just concerned. I am using chrome: 41.0.2272.118 (64-bit) and my os is ubuntu 14.04

I am talking about this:

   <iframe id="fn_layer8" src="http://223.224.131.144:80/l8/Layer8Servlet" target="_blank" frameborder="no" style="display: block !important; opacity: 0 !important; z-index: 2147483646 !important;">
    #document
    <html>
      <head>
        <style type="text/css"></style>
      </head>
      <body>
       <pre style="word-wrap: break-word; white-space: pre-wrap;"></pre>
      </body>
     </html>
    </iframe>
<div id="fnscreenOverlay" style="position: fixed !important; bottom: 0px !important; left: 0px !important; top: auto !important; right: auto !important; height: 2571px !important; z-index: 2147483645 !important; width: 100% !important; text-align: center !important; margin: 0px !important; padding: 0px !important; border: 0px !important; opacity: 0 !important; display: none !important; background-color: transparent !important;"></div>

sonalkr132

Posted 2015-05-21T12:50:45.050

Reputation: 133

Does this happen if you use a proxy or vpn and/or change your DNS provider? Are you using a provider in the part of the world known to insert stuff like this? I inlined the screenshots under the impression the original question at SO could be deleted if it needed to be. – Ramhound – 2015-05-21T14:02:12.003

223.224.131.144 is India Delhi Bharti Airtel Ltd. Is this your ISP? – DavidPostill – 2015-05-21T14:45:31.857

Yes, I use airtel for browsing. I was suspecting that airtel is doing this too, I check if I have same thing in windows (on dual boot) and I do, I have it on my android browser too if I request desktop site. I changed my service provider and all of it was gone (after deleting chache). Should I report this? Why are they doing this? – sonalkr132 – 2015-05-21T15:22:15.173

What's with these stupid ISPs? 1, 2, 3 ...

– Karan – 2015-05-21T19:15:12.583

Answers

<iframe id="fn_layer8" src="http://223.224.131.144:80/l8/Layer8Servlet" target="_blank" frameborder="no" style="display: block !important; opacity: 0 !important; z-index: 2147483646 !important;">

Layer8 press release

Layer8 creates new operator-owned advertising real-estate for more revenue-generating opportunities [...]

Flash Networks [...] is proud to count among its customers top-tier mobile carriers including Bharti Airte [...]

So what you have is an ISP injecting advertising code on the server side. I note that the iframe div is set to transparent, so they are trying to show ads without you seeing them.

Why? Revenue.

Since ads are one of the primary virus vectors, it is not only shady practice, it is actively dangerous to users. (google: malvertising)

Yorik

Posted 2015-05-21T12:50:45.050

Reputation: 2 956

Thanks Yorik! Guess what else? Airtel also closes connection from remote server if it has been idle for a while, which happens quite often when I am pushing code to some slow distant server. It already took me weeks to figure that out and now this -_- – sonalkr132 – 2015-05-21T16:12:27.350

I think you might have a malware infection (as uncommon as that is on Linux). I would scan with an anti-malware/anti-virus program. The Ubuntu documentation has information about Anti-Virus software in Ubuntu.

Gavin.Paolucci.Kleinow

Posted 2015-05-21T12:50:45.050

Reputation: 123