4

This bug is very recent and seemed to appear out of nowhere. The console displays the following error:

VM737:1 GET http://s3.eu-central-1.amazonaws.com/forton/http_headers_1.js

It also seems to sprout in every Wordpress admin page.

I have tried to search the entire wordpress code base for the amazonaws, forton, etc. but could not find what is sending this request to the .js

I searched the internet for the error but only found a korean site with little information.

Any idea what might be causing this error?

3 Answers 3

10

It's Malware effect. Try to check the extentions installed in your browser. Ex. "HTTP Headers" had become malware recently.

5
  • Wow! At first I could not believe it, but it's true. The culprit really was the chrome "HTTP Headers" extension. I would never think that since I got it from the official Chrome Web Store. Well, living and learning... Thanks so much for your help Kobake.
    – Rodrigo
    Nov 7, 2016 at 16:33
  • I would never have figured that out. Thank you very much! Nov 9, 2016 at 0:37
  • Any info on what the malware effects were? searches on HTTP Headers malware only yields results in japanese. Nov 9, 2016 at 14:42
  • http_headers_1.js might be injected by the extension, but the server script file has already been removed so I couldn't research the actual behavior of the scripts.
    – kobake
    Nov 10, 2016 at 4:45
  • I can only say that the injection way of the extention was as evil, so the injected script also should be evil, I think. I saved the extention code here for research. github.com/kobake/http-headers-archives-for-research
    – kobake
    Nov 10, 2016 at 4:53
1

Yes I also removed the chrome HTTP Headers extention and it went away. thank you

1
  • HTTP Headers caused this problem in my case
    – channa ly
    Jun 20, 2017 at 1:27
0

I experienced the same issue. The sponsored by popup occurred twice this morning, once on a Wordpress site (on my imac) and once on a basic HTML site (on my macbook pro). In both instances I was using the Chrome browser and both computers had the HTTP Headers extension installed.

I right-clicked on the popup and selected "Inspect element" which showed the javascript file for the popup: http://s3.eu-central-1.amazonaws.com/forton/http_headers_1.js

That confirmed it was coming from the HTTP Headers extension, so I disabled it by going to Chrome/Preferences. That resolved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.