If this was happening on a 56k modem over a phone line it would clearly be wire tapping. I encouraged the op in another post, https://news.ycombinator.com/item?id=5484850, to contact the FBI. If you see a downside to this let me know, but until I realize one, or have one pointed out I encourage you to do so.

I was just blocking 1.2.3.4, which the inserted js used to download the rest of the "features". I have no reason not to report this to the FBI accept I don't really understand whats going on here so I wouldn't be a good contact.

If you would like to see the content of the script, I can show it to you, it's bit different than the one posted here.