Script substitution on the way to the client (possibly by the provider)

Question

Burglary protection

Hello, help me find where the file is being replaced.

Prehistory: I recently arrived in one of the provincial cities of Ukraine (Luhansk region) and was surprised to notice that on all my sites an advertising block (teaser) appeared on half a page. After a long study of the server logs and sites for traces of hacking, it turned out that the server gives clean code.

What we managed to find out: Teaser images appear for an indefinite period in the evening, on all sites (not only mine) where Ya.Metrika is located, namely, the mc.yandex.ru/metrika/watch.js file is replaced, its contents are replaced by the following pastebin. com/qujq6Ewz from a cursory glance it is clear that advertising (if it is on the site) of many large teaser exchanges is being replaced, and if there was no advertising, then it appears.

I practically exclude that this is a local substitution, according to the following arguments: ubuntu local axis (checked by clamav); works in firefox and chrome and chromium.
More info: Ping mc.yandex.ru during the substitution returns the correct IP, setting google dns did not change the situation (assumed that the ISP had the dns substitution), if you pull the script via wget, then the original is given (but maybe it just coincided), I asked for support Do they have a proxy - they said no.

Any ideas how to check where the substitution is happening?

Answer 1

Perhaps transparent proxying (the so-called transparent proxy) is working, which modifies traffic on the fly (a proxy provider that does not want to admit it).
Try one of these options to find out if this is the case.

Answer 2

Maybe the local neighbors are infected with a virus and are replacing something, for example, pretending to be a DHCP server. Maybe the neighbors in the LAN subsume themselves as a proxy through proxy auto-detection.
Or maybe you have some extensions installed in your browser? Nowadays, extensions are often used for such things.
In general, an interesting case.
> Any ideas how to check where the substitution is taking place?
I would look at the traffic with a program like Wireshark to begin with.

Answer 3

I put on an ADSL router.

Answer 4

It is quite possible for the provider to replace ad units. If the provider makes forced redirection of web traffic to its proxy.
In squid, there is such an opportunity.
You can find out using the directive (if memory serves): X_FORWARDED_FOR.
Yes, and the IP will not be your NAT (unless, of course, they all have more than one machine), but the proxy IP, when entering a speedtest thread.