title: Why is Cloudfront loading scripts in my web app? (I don't use it)
body: <p>I manage a secured PHP/MySQL web app with extensive jQuery use. Today, a strange error popped up in our app's logs:</p>
  
  <pre><code>JS Error: Error loading script:
  https://d15gt9gwxw5wu0.cloudfront.net/js/_MY_WEB_APP_DOMAIN_/r.js
  </code></pre>
  
  <p>We are not using Amazon's Cloudfront CDN in our app. When I go to the URL that failed to load, these are the only contents:</p>
  
  <pre><code>if(typeof _GPL.ri=='function'&amp;&amp;!_GPL.isIE6){_GPL.ri('_GPL_r')}_GPL.rl=true;
  </code></pre>
  
  <p>The user's user agent string is:</p>
  
  <pre><code>Mozilla/5.0 (Windows NT 6.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
  </code></pre>
  
  <p><strong>Please note</strong>: I am not the user who triggered this error. It was one of our thousands of users who triggered it.  I do not have control over the client machine.</p>
  
  <p>Does anyone know what's going on here? Is this some sort of XSS attack?</p>
  
  <p>** <strong>Update</strong> **</p>
  
  <p>It appears I'm not the only one who has discovered this anomaly on their website. I found <a href="http://jsunpack.eyeprotectiongroup.com/dec/go?report=66ffee175f44039da4d67be34f44d84c93afb47a" rel="noreferrer">this report of the same exact behavior</a>, which seems to indicate the code is harmless, but still no answers as to where it came from.</p>
  
  <p>In addition, I found <a href="http://pastebin.com/GYzx83xq" rel="noreferrer">this pastebin with similar code</a>, that appears to be some sort of advertising script. Again, not terribly helpful.</p>
  
  <p>** <strong>Update 2</strong> **</p>
  
  <p>More context: The webapp uses several third party jQuery plugins but no third party analytics of any kind.  All scripts are hosted on our own server, and an audit of all our code provides no matches for "cloudfront".</p>
  
  <p>This app has been in production for about 4 years, and this is the first and only instance of any activity like this. It has not happened before or since, so I doubt I'll be able to reproduce it.</p>
  
  <p>What I'm interested in is if this is some sort of attack. If it is, I want to know how to plug the hole it's trying to exploit if it's not plugged already.</p>