[Hexcles]

FYI, the referer (or referrer, whatever) method might not work well.

The hijacked code does reside on only a few Baidu domains, but it is used (included by <script> tag) by TONS OF Chinese websites. The code is running in these numerous pages which use Baidu products, not just in Baidu pages. Thus, the referer actually varies a lot.

It is really a cleverer solution to notice the subtle difference of the trailing slash.