From the article : "Mitigations These attacks would not be successful if the following resources were served over HTTPS instead of HTTP: http://push.zhanzhan

From the article : "Mitigations These attacks would not be successful if the following resources were served over HTTPS instead of HTTP: http://push.zhanzhang.baidu.com/push.js; http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js http://js.passport.qihucdn.com/11.0.1.js You may want to consider blocking these URLs when not sent over HTTPS."