Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've getting lots of 404 errors from crossdomain.xml. Here are the request details, as provided by Google App Engine:

404 22ms 19cpu_ms 0kb Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
69.130.*.* - - [24/Jul/2011:07:43:42 -0700] "GET /crossdomain.xml HTTP/1.1" 404 124 "http://s.nsdsvc.com/App/DddWrapper.swf?c=3" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "app.*.*.*" ms=22 cpu_ms=19 api_cpu_ms=0 cpm_usd=0.000633 instance=00c61b117c557326bef77d341a345431e66b

I'm not sure what is going on. Can anyone help me solve this issue?

share|improve this question

5 Answers 5

up vote 10 down vote accepted

I also was finding these references in my logs.

This seems to be related to a service called "Drop Down Deals", that involves a browser add-on that seems, well, broken.

http://www.dropdowndeals.com/

https://nodpi.org/forum/index.php?topic=3462.0;wap2

share|improve this answer
    
This looks like it. I'll add a crossdomain.xml file that stops all access, hopefully nothing bad will happen. –  Bogdacutu Jul 27 '11 at 6:04
2  
This is an answer but it's not an answer. Because we still have no incling as to why the service is looking for this script. –  markus Sep 16 '11 at 14:28
3  
This entry isn't due to Drop Down Deals. It's only related to Drop Down Deals in as much as the plugin making the request also uses dddWrapper.swf, which is used by Yontoo (an app platform for ad/spyware-supported browser plugins). And the reason it's requesting crossdomain.xml is pretty obvious. Just google "crossdomain.xml" or search for it on this site and you'll quickly realize why a .swf file would be making this request. –  Lèse majesté Feb 27 '12 at 11:18
    
Lèse: So to verify, the idea is that Yontoo has injected a copy of drop-down deals into large numbers of random websites that you are visiting? –  user9212 Feb 28 '12 at 2:03
2  
@user9212: No, what's happening is someone who has installed a Yontoo-based browser plugin is browsing your site. The browser plugin loads the dddWrapper.swf flash object, which in turn wants to fetch content from your domain. But to do this, it needs to access the cross-domain policy on your site, which is what the crossdomain.xml request is for. The dddWrapper.swf is a part of the Yontoo platform. The "ddd" is not a reference to Drop Down Deals. Drop Down Deals' Yontoo plugin uses it, but so do all of the other Yontoo plugins. –  Lèse majesté Mar 25 '12 at 2:37

This isn't actually related to a firefox plugin, or any plugin at all. crossdomain.xml is part of the flash/flex specification. It's a method to allow/validate cross domain operations for flash and other Adobe products, Sliverlight also seems to use/obey the same adobe policy framework.

From Adobe's Cross-domain policy file specification

A cross-domain policy file is an XML document that grants a web client—such as Adobe Flash Player, Adobe Reader, etc.—permission to handle data across multiple domains. When a client hosts content from a particular source domain and that content makes requests directed towards a domain other than its own, the remote domain would need to host a cross-domain policy file that grants access to the source domain, allowing the client to continue with the transaction. Policy files grant read access to data, permit a client to include custom headers in cross-domain requests, and are also used with sockets to grant permissions for socket-based connections.

Example of a valid crossdomain.xml

<?xml version="1.0" ?>
<cross-domain-policy>
  <site-control permitted-cross-domain-policies="master-only"/>
  <allow-access-from domain="*"/>
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

So it would seem an Adobe product is asking for permission to perform a cross domain operation - I've seen this in my logs before and took it to be a bot looking for a weakness because I could see no other reason for it being there - I would ignore it if it's doing no apparent harm.

share|improve this answer
    
Good explanation. I did know about it already, but it was that addon that caused all of the problems; my site doesn't use Flash at all. –  Bogdacutu Mar 24 '12 at 12:50
    
Hey I found out that I was accessing my flash site without the ""; before the domain. I.e. I was visiting mysite.com/page and getting the crossdomain.xml missing issue. So I used the above sample valid crossdomain.xml file supplied by "toomanyairmiles" and my flash site began working again. Mind you, it was working fine without the crossdomain.xml so long as I visited the site with "mysite.com/page"; instead. –  user20265 Nov 28 '12 at 23:08

Check your browser add-ons and look for something called yontoo.com not sure exactly what it is but if you remove this add-on all seems to go back to normal

share|improve this answer

Do you have flash based adverts on your website, it looks like the 3rd party advert is looking in your domain for the crossdomain.xml.

Speak to your ad company about this.

Was your domain owned by anyone else in the past? It could be that something was setup before you came along.

share|improve this answer
    
I don't have and ads on my website. (yet) –  Bogdacutu Jul 25 '11 at 12:05
    
That's definitely not the case! –  markus Sep 16 '11 at 14:28

To me it's the same, apparently is no attack but be careful because if we are requested to file many times that we can saturate the server

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.