title: Strange Javascript is returned when using php script to periodically check LAMP server homepage
body: <p>I have a cron job setup that runs a php script that checks my server every 5 minutes using file_get_contents() and sends me an email if something is wrong. Twice now I have gotten emails that contain the same javascript snippet instead of the homepage that it is requesting. The script is run from a different webhost.</p>
  
  <p>The page that the script is receiving instead is: </p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
      &lt;title&gt;  &lt;/title&gt;
  
      &lt;script type="text/javascript"&gt;
          function bredir(a, b, c, d, e, ldr, ifc) {
              var h, i, j;
              var f = 0;
              var g = 0;
              var k = false;
              var l = false;
              var m = [
                  [300, 250, false],
                  [250, 250, false],
                  [240, 400, false],
                  [336, 280, false],
                  [180, 150, false],
                  [468, 60, false],
                  [234, 60, false],
                  [88, 31, false],
                  [120, 90, false],
                  [120, 60, false],
                  [120, 240, false],
                  [125, 125, false],
                  [728, 90, false],
                  [160, 600, false],
                  [120, 600, false],
                  [300, 600, false],
                  [300, 125, false],
                  [530, 300, false],
                  [190, 200, false],
                  [470, 250, false],
                  [720, 300, true],
                  [500, 350, true],
                  [550, 480, true],
                  //YouTube:
                  [560, 315, true],
                  [640, 360, true],
                  [853, 480, true],
                  [1280, 720, true],
                  //Vimeo:
                  [400, 300, true],
                  [500, 281, true],
                  //Hulu:
                  [480, 270, true],
                  [512, 288, true],
                  //metacafe:
                  [440, 248, true],
                  [460, 284, true],
                  [540, 304, true],
                  [600, 338, true],
                  //Other dimensions (metacafe, myspace video, yahoo video, break.com, ustream, vevo, justin.tv, etc):
                  [210, 120, true],
                  [400, 300, true],
                  [425, 350, true],
                  [425, 360, true],
                  [435, 251, true],
                  [435, 271, true],
                  [500, 300, true],
                  [525, 295, true],
                  [575, 324, true],
                  [620, 389, true],
                  [624, 351, true],
                  [630, 381, true],
                  [640, 385, true],
                  [650, 368, true],
                  [1000, 562, true],
                  [1000, 563, true],
                  [1000, 564, true]
              ];
              if (typeof window.innerHeight == "number") {
                  g = window.innerHeight;
                  f = window.innerWidth;
              } else if (typeof document.body.offsetHeight == "number") {
                  g = document.body.offsetHeight;
                  f = document.body.offsetWidth;
              }
              for (var n = 0; n &lt; m.length; n++) {
                  j = m[n];
                  h = Math.abs(f - j[0]);
                  i = Math.abs(g - j[1]);
                  if (top != self) {
                      ifc = 1;
                  } else {
                      ifc = 0;
                  };
                  if (h &lt;= 2 &amp;&amp; i &lt;= 2) {
                      k = true;
                      l = j[2]
                  }
              }
              if(f === 0 &amp;&amp; g === 0){
                  return;
              }
              if ((a != "www.facebook.com" &amp;&amp; a != "platform.twitter.com") &amp;&amp; (k || f &lt; 100 &amp;&amp; f !== 0 || g &lt; 100 &amp;&amp; g !== 0)) {
                  if (l &amp;&amp; self == parent) {
                      return;
                  }
                  return "/b" + "anner.php?w=" + f + "&amp;h=" + g + "&amp;d=" + a + "&amp;url=" + b + "&amp;ref=" + c + "&amp;view=" + d
              } else if ((a == "www.facebook.com" || a == "platform.twitter.com") &amp;&amp; (f &gt;= 250 &amp;&amp; g &gt;= 60) &amp;&amp; (k || f &lt; 100 &amp;&amp; f !== 0 || g &lt; 100 &amp;&amp; g !== 0)) {
                  if (l &amp;&amp; self == parent) {
                      return;
                  }
                  return e + "&amp;w=" + f + "&amp;h=" + g + "&amp;ldr=" + "b" + "&amp;ifc=" + ifc;
              } else if ((a == "www.facebook.com" || a == "platform.twitter.com") &amp;&amp; (f &lt; 250 || g &lt; 60) &amp;&amp; (k || f &lt; 100 &amp;&amp; f !== 0 || g &lt; 100 &amp;&amp; g !== 0)) {
                  if (l &amp;&amp; self == parent) {
                      return;
                  }
                  return "/b" + "anner.php?w=" + f + "&amp;h=" + g + "&amp;d=" + a + "&amp;url=" + b + "&amp;ref=" + c + "&amp;view=" + d;
              } else {
                  return e + "&amp;w=" + f + "&amp;h=" + g + "&amp;ifc=" + ifc;
              }
          }
          function bdetect() {
              var loc = bredir(
                  'mydomain.com',
                  'mydomain.com',
                  '',
                  'error',
                  '/main?wc=EWJoExdxBAVDBxduBAoL&amp;url=mydomain.com'
              );
  
              if(typeof loc === 'undefined') {
                  self.close();
                  return;
              }
  
              location.replace(loc);
  
          }
      &lt;/script&gt;
  &lt;/head&gt;
  &lt;body onLoad="bdetect()" style="margin: 0px;"&gt;
      &lt;noscript&gt;
          &lt;iframe frameborder="0" src="/main?wc=EWJoExdxBAVDBxduBAoL&amp;amp;url=mydomain.com" width="100%" height="100%"&gt;&lt;/iframe&gt;
      &lt;/noscript&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p></p>
  
  <p>I've found this code around the web with various errors, but usually it was with iis errors and I'm not really sure why I would ever get this instead of the homepage. </p>
  
  <p>I searched the entire webserver for anything resembling this and found nothing.</p>
  
  <p>A slightly modified version of the php code is:</p>
  
  <pre><code>$mail_these_people = "asdf@mydomain.com,asdf2@mydomain2.com"; 
  $site_foot_code = 'Specific code to look for'; 
  
  $mysite_url = "http://mydomain.com"; 
  $mysite_site_title_code = "More specific txt to look for"; 
  
  $mysite_code = file_get_contents($mysite_url); 
  
  if(strpos($mysite_code,$mysite_site_title_code)===false || strpos($mysite_code,$site_foot_code)===false) 
  { 
          echo "mysite Down\n"; 
          if(mail($mail_these_people,"mysite not showing up correctly!","This is what we got instead:\n\n".$mysite_code)) 
                  echo "Mail sent successfully\n"; 
          else 
                  echo "Mail failded!\m"; 
  } 
  else 
          echo "mysite Up\n"; 
  </code></pre>