Traffic leak - AFF hack?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • CrazyWhiteMan
    Confirmed User
    • Nov 2005
    • 170

    #1

    Traffic leak - AFF hack?

    Hi,

    So about a month ago traffic to my website decreased by around 20%. Initially I though it was google panda update and I was out of luck. The website is hornygamer.com

    However, I noticed something weird - traffic has decreased by a similar percentages from all sources - organic, direct, and referral.

    I am using trade expert paid version, as well as google analytics they both show a decrease in traffic from all sources, which made be alarmed, especially since I know for a fact that the traffic from certain referrals did not change.

    So, I made the following test:

    I purchased a monthly advert on juicyads and sent the traffic to hornygamer.com for about a week. Juicyads said the incoming traffic was about 400/day. Google analytics said it's about 200/day.

    Then after a week, I modified the juicyads advert only by changing the URL, leaving the banner the same, and I directed the traffic to a different website. Juicyads reported roughly similar daily traffic sent. However, the google analytics on my other website reported stats a lot more closer to juicyads figures.

    So, this led me to believe something is not right.

    Then right now I went on a bunch of proxy servers, and tried to access hornygamer.com First few times everything loaded normally, but then some proxy servers redirected to adultfriendfinder!

    So, I am suspecting that somewhere on my server there's some sneaky code that is hijacking a percentage of my traffic to AFF.

    Did this happen to anyone here before? Can you guys check if you get anything from adultfriendfinder when going to hornygamer.com? I got no pop-ups, sliders, or pop-unders, or redirects.
  • newB
    Confirmed User
    • Jul 2006
    • 2870

    #2
    Google link to your site directed me to AFF landing page (pid=p1011105)

    The best Adult Affiliate Programs reviewed and indexed by niche and feature.
    Easily find the sponsors that suit your needs.


    Comment

    • hausarzt
      Confirmed User
      • Jan 2011
      • 818

      #3
      Wanted hornygamer, got hornygamer. No redirect.
      Checked on my android using Chrome.
      I know, my english is bad. But your german might be even worse

      Comment

      • pornmasta
        Too lazy to set a custom title
        • Jun 2006
        • 19841

        #4
        hello i visit you website about 2 time per day and i've never seen this.

        btw you were used to list shark's games and now i see that there is games from them listed on gamcore that aren't listed on your website. (it is the first time that you ar not the first to list them)

        Comment

        • Meloman
          Confirmed User
          • Jul 2001
          • 1540

          #5
          1. Typing in hornygamer.com brought me to hornygamer.com

          2. Searching hornygamer on google and clicking the link brought me to:

          Adult Dating and One Night Stands - AdultFriendFinder

          Comment

          • pornmasta
            Too lazy to set a custom title
            • Jun 2006
            • 19841

            #6
            Originally posted by Meloman
            1. Typing in hornygamer.com brought me to hornygamer.com

            2. Searching hornygamer on google and clicking the link brought me to:

            Adult Dating and One Night Stands - AdultFriendFinder
            yes me too.

            check your htaccess file

            Comment

            • takethebluepill
              So Fucking Banned
              • Dec 2014
              • 241

              #7
              Same....when going from the google result, I can see a total of three hops until it lands on an AFF page. On the second attempt it then goes to your regular front page. I will try to recreate and provide you with the identity of the hops so that you can get rid of the scum.

              Comment

              • xXXtesy10
                Fakecoin Investor
                • Jul 2012
                • 7127

                #8
                all newbies eat ass
                WARNING: Stay Away From Marlboroack aka aka Brandon Ackerman
                http://gfy.com/21169705-post8.html
                Donny Long is Felon, Stalker, Scammer & Coward
                http://www.ripoffreport.com/reports/...lon-int-761244

                Comment

                • ctggls
                  Confirmed User
                  • Aug 2012
                  • 898

                  #9
                  Super strange, i've nerver seen something similar ... Better do something fast you're losing a lot of traffic...

                  Comment

                  • freecartoonporn
                    Confirmed User
                    • Jan 2012
                    • 7683

                    #10
                    its redirecting to adultfriendfinder pid=p1011105

                    someone got your website good.,

                    look htaccess
                    SSD Cloud Server, VPS Server, Simple Cloud Hosting | DigitalOcean

                    Comment

                    • takethebluepill
                      So Fucking Banned
                      • Dec 2014
                      • 241

                      #11
                      Also, appears to be IP based. It only redirects on the first visit to your site, but not on subsequent visits...even after removing cookies.

                      Comment

                      • disinfected
                        So Fucking Banned
                        • Sep 2014
                        • 332

                        #12
                        I've had similar issues in past. It is not just the obvious code that creates the problem, it is the sleeper files that put so far into your file structures.

                        What does host say?

                        If you want another server manager to eradicate all the shit hit up Chris from admin at way3 dut com and tell him the guy who owns videostripgames.com said you may be able to help.

                        How many sites do you have on the server, because it will likely effect them all. My breaches always stemmed from wordpress vulnerability.

                        Comment

                        • CourtneyR
                          Looking for traffic!
                          • Jan 2012
                          • 2989

                          #13
                          CrazyWhiteMan just send you a Private message.

                          telegram: @courtneyrudolph | HUGE Traffic | Camsoda & Camsoda.ai

                          Comment

                          • takethebluepill
                            So Fucking Banned
                            • Dec 2014
                            • 241

                            #14
                            Here's your redirect sequence:

                            Google - Search for horny gamer
                            First Hop: axuv.com
                            Second Hop: escort-ankara.pro
                            Final: AFF

                            Comment

                            • Oracle Porn
                              Affiliate
                              • Oct 2002
                              • 24433

                              #15
                              most likely one of your scripts got hacked


                              Comment

                              • WDF
                                Confirmed User
                                • Jan 2013
                                • 2248

                                #16
                                Talk to Courtney FFN about the aff link if it is not yours.
                                Please HELP

                                Comment

                                • CrazyWhiteMan
                                  Confirmed User
                                  • Nov 2005
                                  • 170

                                  #17
                                  Everyone - thank you for all your help, I appreciate it.

                                  I'm trying to find the source of the leak now, and hopefully get this fixed ASAP. Will let you know how it goes.

                                  Comment

                                  • Seth Manson
                                    Please dont fuck animals
                                    • Jul 2010
                                    • 3988

                                    #18
                                    someone snuck in a 301 or 302 redirect

                                    Comment

                                    • TimS
                                      Confirmed User
                                      • Sep 2014
                                      • 231

                                      #19
                                      Searched on Yahoo and was sent to AFF from the search result.

                                      2nd time it goes to your site.

                                      3 hops as outlined above.

                                      Comment

                                      • tigermtb
                                        Confirmed User
                                        • Nov 2003
                                        • 1062

                                        #20
                                        Sounds like a traffic hijack... either in htaccess or some other code on your website.

                                        You may also sometimes see this with shady advertisers who will redirect a portion of your traffic.

                                        Contact me on an unrelated matter, would like to discuss with you.
                                        Jay | JuicyAds Founder
                                        Businessman of the Year [YNOT Awards 2013]

                                        The most awarded adult advertising network with 25+ XBIZ, GFY, and YNOT Awards.

                                        Comment

                                        • CrazyWhiteMan
                                          Confirmed User
                                          • Nov 2005
                                          • 170

                                          #21
                                          OK, I think I found what it is. I did a quick google search for "pid=p1011105" and seems other websites got infected with exactly the same thing. Which lead me to this:
                                          Apache Binary Backdoors on Cpanel-based servers | Sucuri Blog

                                          Working with my host to fix this now...

                                          Comment

                                          • CrazyWhiteMan
                                            Confirmed User
                                            • Nov 2005
                                            • 170

                                            #22
                                            Some more info on this exploit for those interested: Stealthy, malware-spewing server attack not limited to Apache ? The Register

                                            Comment

                                            • disinfected
                                              So Fucking Banned
                                              • Sep 2014
                                              • 332

                                              #23
                                              Interesting. My host never would install C-Panel on my servers even after asking for it. Was what I used with previous hosts. He has his own server admin software that I can add sites and all of that.

                                              Anyway, good luck. If the issue keeps coming back and becomes "one of those things", give my previous post a read.

                                              Comment

                                              • takethebluepill
                                                So Fucking Banned
                                                • Dec 2014
                                                • 241

                                                #24
                                                In the meantime you can go to /usr/local/apache via ssh and do a string search in all files in the directory for axuv (which is first redirect) and you should be able to find the infected file and entry.

                                                Comment

                                                • takethebluepill
                                                  So Fucking Banned
                                                  • Dec 2014
                                                  • 241

                                                  #25
                                                  Nevermind

                                                  Comment

                                                  • Jel
                                                    Confirmed User
                                                    • Feb 2007
                                                    • 6904

                                                    #26
                                                    should those of us with cpanel hosting be worried? Any easy way to check all sites within a host?

                                                    Comment

                                                    • takethebluepill
                                                      So Fucking Banned
                                                      • Dec 2014
                                                      • 241

                                                      #27
                                                      Check out his last link above about the exploit. That article provides a script to check your files.

                                                      Comment

                                                      • Jel
                                                        Confirmed User
                                                        • Feb 2007
                                                        • 6904

                                                        #28
                                                        I'm a tech dumbass, so guess I'll be using the wing and a prayer method

                                                        Comment

                                                        • Seth Manson
                                                          Please dont fuck animals
                                                          • Jul 2010
                                                          • 3988

                                                          #29
                                                          Sure hope AFF bans the webmaster with pid=p1011105.

                                                          Comment

                                                          • Useless Warrior
                                                            Confirmed User
                                                            • Apr 2004
                                                            • 978

                                                            #30
                                                            Originally posted by Jel
                                                            I'm a tech dumbass, so guess I'll be using the wing and a prayer method
                                                            I never thought of you as the praying type.

                                                            Anyway, it's really something you should leave for your host to patch.
                                                            OWAMW

                                                            Comment

                                                            • Captain Kawaii
                                                              So Fucking Banned
                                                              • Oct 2007
                                                              • 6748

                                                              #31
                                                              Originally posted by Seth Manson
                                                              Sure hope AFF bans the webmaster with pid=p1011105.
                                                              It's great read when you copy/paste and right click that pid into Google search.

                                                              Comment

                                                              • takethebluepill
                                                                So Fucking Banned
                                                                • Dec 2014
                                                                • 241

                                                                #32
                                                                Originally posted by Seth Manson
                                                                Sure hope AFF bans the webmaster with pid=p1011105.
                                                                Unfortunately if Aff does ban him, the culprit will simply change the redirect destination to another program. As noted above, the page does not redirect directly to AFF, but instead hops through 2 sites first, allowing the final address to be altered without having to change the entries on the hijacked servers.
                                                                Best bet might be to send a complaint to the first hops, axuv.com, provider. That address is likely hardcoded into the exploit. If that site goes down, then at least no one will profit from stealing your traffic.

                                                                Comment

                                                                • Jel
                                                                  Confirmed User
                                                                  • Feb 2007
                                                                  • 6904

                                                                  #33
                                                                  Originally posted by Useless Warrior
                                                                  I never thought of you as the praying type.

                                                                  Anyway, it's really something you should leave for your host to patch.
                                                                  Aw c'mon... my persona screams the praying type

                                                                  yeah, I'll do my usual extremely undetailed request and let them take it from there

                                                                  Comment

                                                                  • takethebluepill
                                                                    So Fucking Banned
                                                                    • Dec 2014
                                                                    • 241

                                                                    #34
                                                                    You probably already know this....hornygamer.com is offline.

                                                                    Comment

                                                                    • CrazyWhiteMan
                                                                      Confirmed User
                                                                      • Nov 2005
                                                                      • 170

                                                                      #35
                                                                      OK, I finally got this fixed.

                                                                      We found the surest way to get rid of this malware was to reset the server, so I had the OS reinstalled, and all is good now. Thank you all for your help.

                                                                      Comment

                                                                      • pornmasta
                                                                        Too lazy to set a custom title
                                                                        • Jun 2006
                                                                        • 19841

                                                                        #36
                                                                        bump....

                                                                        Comment

                                                                        Working...