这有点像的XSS，这个不好的是，可以偷你的cookie id 和 session id， 应该是嵌入了一些代码， 大概看了以下，怀疑是一些网站广告。。。Chrome和自动拦截这些，但是 iphone的safari似乎没有去拦截
Refused to execute script from 'https://slack.sp1.convertro.com/view/vt/v1/slack/0/cvo.gif?cvosrc=display.adroll.aud_prosp_click&utm_source=adroll&utm_medium=display&utm_content=315928962&utm_campaign=wwh' because its MIME type ('image/gif') is not executable.
3show_i.php?a=39&x=TVRVeE1EazBNemM0TlMwMU1DNHhPVFV1TVRRMkxqRTROdz09&z=29&c=1&target=_top&refer=htttp%3A%2F%2Fforums.huaren.us%2Fshowtopic.aspx%3Ftopicid%3D2233381%26page%3D2:1

Refused to execute script from 'https://sync.1rx.io/usersync2/pulse' because its MIME type ('image/gif') is not executable.
这两个网站都包含 cross domain inject