Has this website been hacked?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • MattO
    The O is for Oohhh
    • Feb 2003
    • 10861

    #1

    Has this website been hacked?

    Check this out:

    http://www.megunyc.com/

    It's a site for a NYC Japanese restaurant. But when you view the source code from the opening screen, you find this down at the bottom:

    Code:
    <li><a  style="text-decoration: none;" href="images/1/backseatbangers.html">Backseatbangers</a>
    <li><a  style="text-decoration: none;" href="images/1/big-naturals.html">Big Naturals</a>
    <li><a  style="text-decoration: none;" href="images/1/captain-stabbin.html">Captain Stabbin</a>
    <li><a  style="text-decoration: none;" href="images/1/cum.html">Cum</a>
    <li><a  style="text-decoration: none;" href="images/1/cum-fiesta.html">Cum Fiesta</a>
    <li><a  style="text-decoration: none;" href="images/1/gang-bang-squad.html">Gang Bang Squad</a>
    <li><a  style="text-decoration: none;" href="images/1/her-first-big-cock.html">Her First Big Cock</a>
    <li><a  style="text-decoration: none;" href="images/1/inthevip.html">Inthevip</a>
    <li><a  style="text-decoration: none;" href="images/1/8th-street-latinas.html">8th street latinas</a>
    <li><a  style="text-decoration: none;" href="images/1/massive-cocks.html">Massive Cocks</a>
    <li><a  style="text-decoration: none;" href="images/1/mikes-apartment.html">Mikes Apartment</a>
    <li><a  style="text-decoration: none;" href="images/1/milf-seeker.html">Milf Seeker</a>
    <li><a  style="text-decoration: none;" href="images/1/milf-seekers.html">Milf Seekers</a>
    <li><a  style="text-decoration: none;" href="images/1/teens-for-cash.html">Teens for Cash</a>
    <li><a  style="text-decoration: none;" href="images/1/tits.html">Tits</a>
    <li><a  style="text-decoration: none;" href="images/1/sapphic-erotica.html">Sapphic Erotica</a>
    <li><a  style="text-decoration: none;" href="images/1/milf-hunter.html">Milf Hunter</a
    <BR>
    <a style="text-decoration: none;" href="http://www.cumfiesta.com/5/main.htm?id=capon" title="Cum Fiesta"><b>Cum Fiesta</b></a> 
    <a  style="text-decoration: none;" href="http://www.cumfiesta.com/5/main.htm?id=capon" title="Cum"><b>Cum</b></a>
    <a  style="text-decoration: none;" href="http://www.captainstabbin.com/4/main.htm?id=capon" title="Captain Stabbin"><b>Captain Stabbin</b></a>
    <a  style="text-decoration: none;" href="http://www.bignaturals.com/main.htm?id=capon" title="Big Naturals"><b>Big Naturals</b></a> 
    <a  style="text-decoration: none;" href="http://www.mikesapartment.com/2/main.htm?id=capon" title="Mikes Apartment"><b>Mikes Apartment</b></a>
    <a  style="text-decoration: none;" href="http://www.inthevip.com/gallys/?id=capon" title="Inthevip"><B>Inthevip</B></a>
    <a  style="text-decoration: none;" href="http://www.8thstreetlatinas.com/main.htm?id=capon" title="8th street latinas"><B>8th street latinas</B></a>
    <a  style="text-decoration: none;" href="http://www.milfseeker.com/?revid=39920&s=2" title="Milf Seeker"><b>Milf Seeker</b></a> 
    <a  style="text-decoration: none;" href="http://www.milfseeker.com/?revid=39920&s=2" title="Milf Seekers"><b>Milf Seekers</b></a>
    <a  style="text-decoration: none;" href="http://www.bigcocksex.com/?revid=39920&s=3" title="Massive Cocks"><b>Massive Cocks</b></a>
    <a  style="text-decoration: none;" href="http://www.teensforcash.com/?revid=39920&s=2" title="Teens for Cash"><b>Teens for Cash</b></a>
    <a  style="text-decoration: none;" href="http://www.herfirstbigcock.com/?revid=39920&s=1" title="Her First Big Cock"><b>Her First Big Cock</b></a>
    <a  style="text-decoration: none;" href="http://www.backseatbangers.com/?revid=39920&s=1" title="Backseatbangers"><b>Backseatbangers</b></a> 
    <a  style="text-decoration: none;" href="http://www.gangbangsquad.com/?revid=39920&s=1" title="Gang Bang Squad"><b>Gang Bang Squad</b></a>
    <b><a  style="text-decoration: none;" href="http://www.bigtitsroundasses.com/t1/pps=younfp/">Tits</a></b>
    <b><a  style="text-decoration: none;" href="http://in.sapphicerotica.com/track/MzEwMDozOjE/">Sapphic Erotica</a></b>
    <b><a  style="text-decoration: none;" href="http://www.milfhunter.com/4/main.htm?id=capon">Milf Hunter</a></b>
    Completely hidden links to NastyDollars & TopBucks sites.
    The pages on the site such as:
    http://www.megunyc.com/images/1/teens-for-cash.html
    Goes to a SE spam page. Down at the bottom of this page is a link without an affiliate code going to:
    http://hotsexdir.com/
    Which has the title "Rape Sex & Porn" and is registered to someone in Poland.

    So I think it was either hacked, or the webmaster for the site put in that code without the owners of the restaurant knowing about it.
    Last edited by MattO; 12-10-2005, 10:03 PM.
  • disregard
    Confirmed User
    • May 2004
    • 118

    #2
    Wow.. get something like this on a popular website, and you are essentially stealing from other webmasters on any program that credits the *first* webmaster who refers to another site.

    Do common affiliate programs protect against this type of thing?
    house o' fart

    Comment

    • MattO
      The O is for Oohhh
      • Feb 2003
      • 10861

      #3
      Well it's not forcing clicks from surfers, but it is getting some good page rankings.

      Comment

      • JD
        Too lazy to set a custom title
        • Sep 2003
        • 22651

        #4
        wow. that fucking sucks.

        Comment

        • LiveDose
          Show Yer Tits!
          • Feb 2002
          • 25792

          #5
          Damn that's funny...

          Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal

          Comment

          • MattO
            The O is for Oohhh
            • Feb 2003
            • 10861

            #6
            Do a google search for "teens for cash" and check the ref code in the first result against the ref code in the code I pasted. (it cycles between a couple top listings sometimes)

            I'll make it easier: revid=39920

            So if it is a hacker they're doing something that works for them.

            Comment

            • JD
              Too lazy to set a custom title
              • Sep 2003
              • 22651

              #7
              Originally posted by MattO
              Do a google search for "teens for cash" and check the ref code in the first result against the ref code in the code I pasted. (it cycles between a couple top listings sometimes)

              I'll make it easier: revid=39920

              So if it is a hacker they're doing something that works for them.
              wtf? the cached page is a 404

              Comment

              • MattO
                The O is for Oohhh
                • Feb 2003
                • 10861

                #8
                Originally posted by SPeRMiNaToR
                wtf? the cached page is a 404

                Yea I noticed that earlier, it's wacky, eh?

                Comment

                • kaori
                  Confirmed User
                  • Apr 2005
                  • 1569

                  #9
                  Originally posted by disregard
                  Wow.. get something like this on a popular website, and you are essentially stealing from other webmasters on any program that credits the *first* webmaster who refers to another site.

                  Do common affiliate programs protect against this type of thing?
                  I don't think many programs credit the first webmaster.. I believe the cookies are almost always overwritten...

                  besides, this code is just for SE spam... it just links to pages like:
                  http://www.megunyc.com/images/1/mikes-apartment.html

                  Comment

                  • SmokeyTheBear
                    ►SouthOfHeaven
                    • Jun 2004
                    • 28609

                    #10
                    http://www.netpond.com/member.php?u=11154
                    hatisblack at yahoo.com

                    Comment

                    • MattO
                      The O is for Oohhh
                      • Feb 2003
                      • 10861

                      #11
                      Originally posted by SmokeyTheBear
                      I'm not sure I see the connection.

                      Comment

                      • MattO
                        The O is for Oohhh
                        • Feb 2003
                        • 10861

                        #12
                        Ahh, nevermind, I see the links there. Hmm.

                        Comment

                        • Deej
                          I make pixels work
                          • Jun 2005
                          • 24386

                          #13
                          hidden links....spiders see them....surfers dont.....pure rankings

                          Deej's Designs n' What Not
                          Hit me up for Design, CSS & Photo Retouching


                          Icq#30096880

                          Comment

                          • MattO
                            The O is for Oohhh
                            • Feb 2003
                            • 10861

                            #14
                            I don't think that guy is the hacker, Smokey, I think he got hacked. It's the same block of code that's on other sites, plus it doesn't match the topbucks refcode on the top of the page. It looks pasted in.

                            And check this out:

                            http://www.vgln.com/
                            http://wheretodoresearch.com/
                            http://www.care-connection.com/subs.html
                            http://www.care-connection.com/
                            http://www.placeoftheskull.com/
                            http://www.irenclub.org/
                            http://www.collisiondetection.net/mt...es/000107.html

                            View the source, they've all been hacked with the same code.

                            Comment

                            • SmokeyTheBear
                              ►SouthOfHeaven
                              • Jun 2004
                              • 28609

                              #15
                              Originally posted by MattO
                              I don't think that guy is the hacker, Smokey, I think he got hacked. It's the same block of code that's on other sites, plus it doesn't match the topbucks refcode on the top of the page. It looks pasted in.

                              And check this out:

                              http://www.vgln.com/
                              http://wheretodoresearch.com/
                              http://www.care-connection.com/subs.html
                              http://www.care-connection.com/
                              http://www.placeoftheskull.com/
                              http://www.irenclub.org/
                              http://www.collisiondetection.net/mt...es/000107.html

                              View the source, they've all been hacked with the same code.

                              i didnt go that way .. look at the nastydollars id on each of those sites , then look at

                              www.worldsblogs.com
                              hatisblack at yahoo.com

                              Comment

                              • SmokeyTheBear
                                ►SouthOfHeaven
                                • Jun 2004
                                • 28609

                                #16
                                and all the domain records are generally the same russian area..

                                looks like just a clever use of hacking to me, instead of displaying some stupid message he added a little hidden code for seo purposes..
                                hatisblack at yahoo.com

                                Comment

                                • SmokeyTheBear
                                  ►SouthOfHeaven
                                  • Jun 2004
                                  • 28609

                                  #17
                                  of course i wouldnt crucify the guy just yet someone could be doing it to hurt him as revenge or something also.. there are many reasons.. but just stating the most obvious..
                                  hatisblack at yahoo.com

                                  Comment

                                  • MattO
                                    The O is for Oohhh
                                    • Feb 2003
                                    • 10861

                                    #18
                                    Ah I see, Smokey. Interesting.

                                    Comment

                                    • MattO
                                      The O is for Oohhh
                                      • Feb 2003
                                      • 10861

                                      #19
                                      Bump....

                                      Comment

                                      • MattO
                                        The O is for Oohhh
                                        • Feb 2003
                                        • 10861

                                        #20
                                        Seems like some of the sites have "found out" about the hack job had have gotten rid of some of the hacked pages. Not most, though.

                                        Other than http://worldsblog.com the same guy has the site http://www.youneedfreeporn.com/ which also had the same codes on them, but have mysteriously dissappeared in the last day.

                                        Google Archive:
                                        http://64.233.187.104/search?q=cache...porn.com&hl=en
                                        Looks like this guy's the hacker. He's on this board too.

                                        His rape site has broken graphics on it now. Wonder if that's a bust?
                                        Last edited by MattO; 12-14-2005, 07:23 PM.

                                        Comment

                                        • MattO
                                          The O is for Oohhh
                                          • Feb 2003
                                          • 10861

                                          #21
                                          Another site, same guy, same codes

                                          http://worldsporn.com/

                                          Comment

                                          • Rob
                                            I'm a great bowler.
                                            • Nov 2003
                                            • 13310

                                            #22
                                            Same shit happened to me about a year ago with a couple of my sites.

                                            Turns out that it was a PhpBB glitch and hackers exploited it to get the admin login. They used it to hide links, etc. With one of my sites they installed a popup and I didn't know about it until about 5 months later when I went to view it. One of my sites had a Google PR of 5 so the link had to have helped their SEO.

                                            Comment

                                            • Rob
                                              I'm a great bowler.
                                              • Nov 2003
                                              • 13310

                                              #23
                                              However, if you were a web developer and had several sites with high PR then that would be an extremely clever thing to do in order to boost up your other sites. Your client would never know and neither would the ordinary web surfer.

                                              Comment

                                              • PixeLs
                                                Too lazy to set a custom title
                                                • Jul 2005
                                                • 11922

                                                #24
                                                Oh my, that looks fucked up in here..

                                                Make money on any traffic.
                                                Bi-weekly payments with no hold.

                                                Comment

                                                • feclstrm
                                                  Registered User
                                                  • Dec 2005
                                                  • 54

                                                  #25
                                                  Many times this happens when a domain drops and another webmaster picks it up. The webmaster then goes to archive.org and gets the pages that were originally on the site and then hides the SEO code within the site.


                                                  Thus the reason dropped domains are so popular.

                                                  Comment

                                                  • MattO
                                                    The O is for Oohhh
                                                    • Feb 2003
                                                    • 10861

                                                    #26
                                                    Originally posted by feclstrm
                                                    Many times this happens when a domain drops and another webmaster picks it up. The webmaster then goes to archive.org and gets the pages that were originally on the site and then hides the SEO code within the site.


                                                    Thus the reason dropped domains are so popular.
                                                    The whois on all those domains is still pointing to the "correct" owners. The Japanese Restaurant in my OP hasn't been dropped for sure. But I can see what you're talking about, I let a domain expire once and someone did just that, although the PR was 0

                                                    Comment

                                                    Working...