Suspicious source URL changes.

I’ve noticed over the past couple of weeks that there seems to be a group of s going around changing source URLs to highly suspicious Russian domains.
 
Examples can be found here and here.
 
Any idea what this is all about? Is there any way to stop or prevent it, or can we only be vigilant to change them back when it happens?

Those domains are alternative domains for daidostup.ru (at least going by a meta tag), which is d as an anonymizer. The likely means well, but canonical URLs are obviously desired.
 
(I have messaged both of them.)