What is this "thing"?

[britechguy]

My partner has recently become a business partner in a small local fabric store. Their website is: https://www.ragtimefabrics.com

Recently, and I have no idea of exactly when this started, you get the following appearing at the top of their webpage above the actual content:

The "Uh Oh" box has its own scrollbar on the right and it's entirely contained within the webpage.

I have to believe this is a hack of some kind, but I have no idea what kind, so I thought I'd ask here. I imagine wiping the site on the host and re-uploading it would clear things up, but . . .

BTW, the domain registrar is GoDaddy, but I do not yet know whether they host the site or not.

 

[tf76]

View the source of the page for code that looks out of place

 

[britechguy]

@tf76

Of course. My main question is whether this looks like something anyone here recognizes on sight and may have information regarding how it comes to occur in the first place.

It's very early days.

 

[trevm999]

https://www.reviewlead.com/button/ragtimefabrics/?content=Tell Us What You Think About Ragtime!&xdm_e=https://www.ragtimefabrics.com&xdm_c=default2539&xdm_p=1

 

[phaZed]

It's an iFrame - a frame that loads an external website URL (In this case, reviews or a "Review Us Button" for Ragtime, from Reviewlead.com - and the URL is currently non-existent. Looks like it's a paid-for service, so maybe their account went inactive.

https://www.reviewlead.com/button/ragtimefabrics/?content=Tell%20Us%20What%20You%20Think%20About%20Ragtime!&xdm_e=https%3A%2F%2Fwww.ragtimefabrics.com&xdm_c=default771&xdm_p=1

 

[britechguy]

Thank you, gentlemen. At least this gives me a starting point!

 

[Fred Claus]

My partner recently became a business partner in a small local fabric store. Their website is: https://www.ragtimefabrics.com.

Recently, and I have no idea exactly when this started, you get the following appearing at the top of their webpage above the actual content:View attachment 17173

The "Uh Oh" box has its scrollbar on the right, and it's contained entirely on the webpage.

I believe this is a hack, but I have no idea what kind, so I wanted to ask here. I imagine wiping the site on the host and re-uploading it would clear things up, but . . .

The domain registrar is GoDaddy, but I do not yet know whether they will host the site.

Do you know if this is a WordPress site? I've not seen this myself, but a plugin on the site shows something on top of the headerbar. It's pulling the data for that section from another site. The site it's trying to draw from is not working so it shows you this message. It's a custom message you get instead of a 404 error. It was either set by the plugin or the site from which the information should be coming.

 

[britechguy]

@Fred Claus

I do believe the culprit has been accurately identified by both @trevm999 and @phaZed, with the latter even providing a screenshot of the source code from the webpage.

It's not, to my knowledge, a WordPress site, but the nature of "the thing" is entirely consistent with your description, but has already been zeroed in upon.

 

[Fred Claus]

@Fred Claus

I do believe the culprit has been accurately identified by both @trevm999 and @phaZed, with the latter even providing a screenshot of the source code from the webpage.

It's not, to my knowledge, a WordPress site, but the nature of "the thing" is entirely consistent with your description, but has already been zeroed in upon.

I guess I should have read all the replies first. I didn't notice that it was solved. That's some interesting code.

 

[britechguy]

I guess I should have read all the replies first.

As I am not moderator here, nor do I want to appear unappreciative or unfriendly, I didn't come out and say this. But it is always best practice to get oneself completely up to speed on a given thread before posting any reply.

I do appreciate that you took the time to reply.