Has this website been hacked? - GoFuckYourself.com

MattO · 12-11-2005, 12:02 AM

Check this out:

http://www.megunyc.com/

It's a site for a NYC Japanese restaurant. But when you view the source code from the opening screen, you find this down at the bottom:

Code:

<li><a  style="text-decoration: none;" href="images/1/backseatbangers.html">Backseatbangers</a>
<li><a  style="text-decoration: none;" href="images/1/big-naturals.html">Big Naturals</a>
<li><a  style="text-decoration: none;" href="images/1/captain-stabbin.html">Captain Stabbin</a>
<li><a  style="text-decoration: none;" href="images/1/cum.html">Cum</a>
<li><a  style="text-decoration: none;" href="images/1/cum-fiesta.html">Cum Fiesta</a>
<li><a  style="text-decoration: none;" href="images/1/gang-bang-squad.html">Gang Bang Squad</a>
<li><a  style="text-decoration: none;" href="images/1/her-first-big-cock.html">Her First Big Cock</a>
<li><a  style="text-decoration: none;" href="images/1/inthevip.html">Inthevip</a>
<li><a  style="text-decoration: none;" href="images/1/8th-street-latinas.html">8th street latinas</a>
<li><a  style="text-decoration: none;" href="images/1/massive-cocks.html">Massive Cocks</a>
<li><a  style="text-decoration: none;" href="images/1/mikes-apartment.html">Mikes Apartment</a>
<li><a  style="text-decoration: none;" href="images/1/milf-seeker.html">Milf Seeker</a>
<li><a  style="text-decoration: none;" href="images/1/milf-seekers.html">Milf Seekers</a>
<li><a  style="text-decoration: none;" href="images/1/teens-for-cash.html">Teens for Cash</a>
<li><a  style="text-decoration: none;" href="images/1/tits.html">Tits</a>
<li><a  style="text-decoration: none;" href="images/1/sapphic-erotica.html">Sapphic Erotica</a>
<li><a  style="text-decoration: none;" href="images/1/milf-hunter.html">Milf Hunter</a
<BR>
<a style="text-decoration: none;" href="http://www.cumfiesta.com/5/main.htm?id=capon" title="Cum Fiesta"><b>Cum Fiesta</b></a> 
<a  style="text-decoration: none;" href="http://www.cumfiesta.com/5/main.htm?id=capon" title="Cum"><b>Cum</b></a>
<a  style="text-decoration: none;" href="http://www.captainstabbin.com/4/main.htm?id=capon" title="Captain Stabbin"><b>Captain Stabbin</b></a>
<a  style="text-decoration: none;" href="http://www.bignaturals.com/main.htm?id=capon" title="Big Naturals"><b>Big Naturals</b></a> 
<a  style="text-decoration: none;" href="http://www.mikesapartment.com/2/main.htm?id=capon" title="Mikes Apartment"><b>Mikes Apartment</b></a>
<a  style="text-decoration: none;" href="http://www.inthevip.com/gallys/?id=capon" title="Inthevip"><B>Inthevip</B></a>
<a  style="text-decoration: none;" href="http://www.8thstreetlatinas.com/main.htm?id=capon" title="8th street latinas"><B>8th street latinas</B></a>
<a  style="text-decoration: none;" href="http://www.milfseeker.com/?revid=39920&s=2" title="Milf Seeker"><b>Milf Seeker</b></a> 
<a  style="text-decoration: none;" href="http://www.milfseeker.com/?revid=39920&s=2" title="Milf Seekers"><b>Milf Seekers</b></a>
<a  style="text-decoration: none;" href="http://www.bigcocksex.com/?revid=39920&s=3" title="Massive Cocks"><b>Massive Cocks</b></a>
<a  style="text-decoration: none;" href="http://www.teensforcash.com/?revid=39920&s=2" title="Teens for Cash"><b>Teens for Cash</b></a>
<a  style="text-decoration: none;" href="http://www.herfirstbigcock.com/?revid=39920&s=1" title="Her First Big Cock"><b>Her First Big Cock</b></a>
<a  style="text-decoration: none;" href="http://www.backseatbangers.com/?revid=39920&s=1" title="Backseatbangers"><b>Backseatbangers</b></a> 
<a  style="text-decoration: none;" href="http://www.gangbangsquad.com/?revid=39920&s=1" title="Gang Bang Squad"><b>Gang Bang Squad</b></a>
<b><a  style="text-decoration: none;" href="http://www.bigtitsroundasses.com/t1/pps=younfp/">Tits</a></b>
<b><a  style="text-decoration: none;" href="http://in.sapphicerotica.com/track/MzEwMDozOjE/">Sapphic Erotica</a></b>
<b><a  style="text-decoration: none;" href="http://www.milfhunter.com/4/main.htm?id=capon">Milf Hunter</a></b>

Completely hidden links to NastyDollars & TopBucks sites.
The pages on the site such as:
http://www.megunyc.com/images/1/teens-for-cash.html
Goes to a SE spam page. Down at the bottom of this page is a link without an affiliate code going to:
http://hotsexdir.com/
Which has the title "Rape Sex & Porn" and is registered to someone in Poland.

So I think it was either hacked, or the webmaster for the site put in that code without the owners of the restaurant knowing about it.

disregard · 12-11-2005, 12:05 AM

Wow.. get something like this on a popular website, and you are essentially stealing from other webmasters on any program that credits the *first* webmaster who refers to another site.

Do common affiliate programs protect against this type of thing?

MattO · 12-11-2005, 12:06 AM

Well it's not forcing clicks from surfers, but it is getting some good page rankings.

JD · 12-11-2005, 12:09 AM

wow. that fucking sucks.

LiveDose · 12-11-2005, 12:09 AM

Damn that's funny...

MattO · 12-11-2005, 12:13 AM

Do a google search for "teens for cash" and check the ref code in the first result against the ref code in the code I pasted. (it cycles between a couple top listings sometimes)

I'll make it easier: revid=39920

So if it is a hacker they're doing something that works for them.

JD · 12-11-2005, 12:28 AM

Quote:

Originally Posted by MattO

Do a google search for "teens for cash" and check the ref code in the first result against the ref code in the code I pasted. (it cycles between a couple top listings sometimes)

I'll make it easier: revid=39920

So if it is a hacker they're doing something that works for them.

wtf? the cached page is a 404

MattO · 12-11-2005, 12:31 AM

Quote:

Originally Posted by SPeRMiNaToR

wtf? the cached page is a 404

Yea I noticed that earlier, it's wacky, eh?

kaori · 12-11-2005, 12:42 AM

Quote:

Originally Posted by disregard

Wow.. get something like this on a popular website, and you are essentially stealing from other webmasters on any program that credits the *first* webmaster who refers to another site.

Do common affiliate programs protect against this type of thing?

I don't think many programs credit the first webmaster.. I believe the cookies are almost always overwritten...

besides, this code is just for SE spam... it just links to pages like:
http://www.megunyc.com/images/1/mikes-apartment.html

SmokeyTheBear · 12-11-2005, 01:02 AM

http://www.netpond.com/member.php?u=11154

MattO · 12-11-2005, 01:13 AM

Quote:

Originally Posted by SmokeyTheBear

http://www.netpond.com/member.php?u=11154

I'm not sure I see the connection.

MattO · 12-11-2005, 01:17 AM

Ahh, nevermind, I see the links there. Hmm.

Deej · 12-11-2005, 01:21 AM

hidden links....spiders see them....surfers dont.....pure rankings

MattO · 12-11-2005, 01:30 AM

I don't think that guy is the hacker, Smokey, I think he got hacked. It's the same block of code that's on other sites, plus it doesn't match the topbucks refcode on the top of the page. It looks pasted in.

And check this out:

http://www.vgln.com/
http://wheretodoresearch.com/
http://www.care-connection.com/subs.html
http://www.care-connection.com/
http://www.placeoftheskull.com/
http://www.irenclub.org/
http://www.collisiondetection.net/mt...es/000107.html

View the source, they've all been hacked with the same code.

SmokeyTheBear · 12-11-2005, 03:34 AM

Quote:

Originally Posted by MattO

I don't think that guy is the hacker, Smokey, I think he got hacked. It's the same block of code that's on other sites, plus it doesn't match the topbucks refcode on the top of the page. It looks pasted in.

And check this out:

http://www.vgln.com/
http://wheretodoresearch.com/
http://www.care-connection.com/subs.html
http://www.care-connection.com/
http://www.placeoftheskull.com/
http://www.irenclub.org/
http://www.collisiondetection.net/mt...es/000107.html

View the source, they've all been hacked with the same code.

i didnt go that way .. look at the nastydollars id on each of those sites , then look at

www.worldsblogs.com

SmokeyTheBear · 12-11-2005, 03:37 AM

and all the domain records are generally the same russian area..

looks like just a clever use of hacking to me, instead of displaying some stupid message he added a little hidden code for seo purposes..

SmokeyTheBear · 12-11-2005, 03:38 AM

of course i wouldnt crucify the guy just yet someone could be doing it to hurt him as revenge or something also.. there are many reasons.. but just stating the most obvious..

MattO · 12-11-2005, 06:54 AM

Ah I see, Smokey. Interesting.

MattO · 12-12-2005, 11:47 AM

Bump....

MattO · 12-14-2005, 09:22 PM

Seems like some of the sites have "found out" about the hack job had have gotten rid of some of the hacked pages. Not most, though.

Other than http://worldsblog.com the same guy has the site http://www.youneedfreeporn.com/ which also had the same codes on them, but have mysteriously dissappeared in the last day.

Google Archive:
http://64.233.187.104/search?q=cache...porn.com&hl=en
Looks like this guy's the hacker. He's on this board too.

His rape site has broken graphics on it now. Wonder if that's a bust?

MattO · 12-14-2005, 09:29 PM

Another site, same guy, same codes

http://worldsporn.com/

Rob · 12-14-2005, 09:33 PM

Same shit happened to me about a year ago with a couple of my sites.

Turns out that it was a PhpBB glitch and hackers exploited it to get the admin login. They used it to hide links, etc. With one of my sites they installed a popup and I didn't know about it until about 5 months later when I went to view it. One of my sites had a Google PR of 5 so the link had to have helped their SEO.

Rob · 12-14-2005, 09:36 PM

However, if you were a web developer and had several sites with high PR then that would be an extremely clever thing to do in order to boost up your other sites. Your client would never know and neither would the ordinary web surfer.

PixeLs · 12-14-2005, 10:42 PM

Oh my, that looks fucked up in here..

feclstrm · 12-14-2005, 10:46 PM

Many times this happens when a domain drops and another webmaster picks it up. The webmaster then goes to archive.org and gets the pages that were originally on the site and then hides the SEO code within the site.

Thus the reason dropped domains are so popular.

MattO · 12-14-2005, 10:49 PM

Quote:

Originally Posted by feclstrm

Many times this happens when a domain drops and another webmaster picks it up. The webmaster then goes to archive.org and gets the pages that were originally on the site and then hides the SEO code within the site.

Thus the reason dropped domains are so popular.

The whois on all those domains is still pointing to the "correct" owners. The Japanese Restaurant in my OP hasn't been dropped for sure. But I can see what you're talking about, I let a domain expire once and someone did just that, although the PR was 0

12-11-2005, 12:05 AM	#2
disregard Confirmed User Join Date: May 2004 Posts: 118	Wow.. get something like this on a popular website, and you are essentially stealing from other webmasters on any program that credits the first webmaster who refers to another site. Do common affiliate programs protect against this type of thing? __________________ house o' fart

12-11-2005, 12:09 AM	#5
LiveDose Show Yer Tits! Industry Role: Join Date: Feb 2002 Location: Somewhere Out there... Posts: 25,792	Damn that's funny... __________________ Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal

12-11-2005, 01:02 AM	#10
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	http://www.netpond.com/member.php?u=11154 __________________ hatisblack at yahoo.com

12-11-2005, 01:21 AM	#13
Deej I make pixels work Industry Role: Join Date: Jun 2005 Location: I live here... Posts: 24,386	hidden links....spiders see them....surfers dont.....pure rankings __________________ Deej's Designs n' What Not Hit me up for Design, CSS & Photo Retouching Icq#30096880

12-11-2005, 03:37 AM	#16
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	and all the domain records are generally the same russian area.. looks like just a clever use of hacking to me, instead of displaying some stupid message he added a little hidden code for seo purposes.. __________________ hatisblack at yahoo.com

12-11-2005, 12:06 AM	#3
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Well it's not forcing clicks from surfers, but it is getting some good page rankings.

12-11-2005, 12:09 AM	#4
JD Too lazy to set a custom title Industry Role: Join Date: Sep 2003 Posts: 22,651	wow. that fucking sucks.

12-11-2005, 12:13 AM	#6
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Do a google search for "teens for cash" and check the ref code in the first result against the ref code in the code I pasted. (it cycles between a couple top listings sometimes) I'll make it easier: revid=39920 So if it is a hacker they're doing something that works for them.

12-11-2005, 01:17 AM	#12
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Ahh, nevermind, I see the links there. Hmm.

12-11-2005, 01:30 AM	#14
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	I don't think that guy is the hacker, Smokey, I think he got hacked. It's the same block of code that's on other sites, plus it doesn't match the topbucks refcode on the top of the page. It looks pasted in. And check this out: http://www.vgln.com/ http://wheretodoresearch.com/ http://www.care-connection.com/subs.html http://www.care-connection.com/ http://www.placeoftheskull.com/ http://www.irenclub.org/ http://www.collisiondetection.net/mt...es/000107.html View the source, they've all been hacked with the same code.

12-11-2005, 03:38 AM	#17
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	of course i wouldnt crucify the guy just yet someone could be doing it to hurt him as revenge or something also.. there are many reasons.. but just stating the most obvious.. __________________ hatisblack at yahoo.com

12-11-2005, 06:54 AM	#18
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Ah I see, Smokey. Interesting.

12-12-2005, 11:47 AM	#19
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Bump....

12-14-2005, 09:22 PM	#20
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Seems like some of the sites have "found out" about the hack job had have gotten rid of some of the hacked pages. Not most, though. Other than http://worldsblog.com the same guy has the site http://www.youneedfreeporn.com/ which also had the same codes on them, but have mysteriously dissappeared in the last day. Google Archive: http://64.233.187.104/search?q=cache...porn.com&hl=en Looks like this guy's the hacker. He's on this board too. His rape site has broken graphics on it now. Wonder if that's a bust? Last edited by MattO; 12-14-2005 at 09:23 PM..

12-14-2005, 09:29 PM	#21
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	Another site, same guy, same codes http://worldsporn.com/

12-14-2005, 09:33 PM	#22
Rob I'm a great bowler. Industry Role: Join Date: Nov 2003 Location: Right Outside of Normal. Posts: 13,309	Same shit happened to me about a year ago with a couple of my sites. Turns out that it was a PhpBB glitch and hackers exploited it to get the admin login. They used it to hide links, etc. With one of my sites they installed a popup and I didn't know about it until about 5 months later when I went to view it. One of my sites had a Google PR of 5 so the link had to have helped their SEO. __________________

12-14-2005, 09:36 PM	#23
Rob I'm a great bowler. Industry Role: Join Date: Nov 2003 Location: Right Outside of Normal. Posts: 13,309	However, if you were a web developer and had several sites with high PR then that would be an extremely clever thing to do in order to boost up your other sites. Your client would never know and neither would the ordinary web surfer. __________________

12-14-2005, 10:42 PM	#24
PixeLs Too lazy to set a custom title Join Date: Jul 2005 Posts: 11,922	Oh my, that looks fucked up in here.. __________________ Make money on any traffic. Bi-weekly payments with no hold.

12-14-2005, 10:46 PM	#25
feclstrm Registered User Join Date: Dec 2005 Posts: 54	Many times this happens when a domain drops and another webmaster picks it up. The webmaster then goes to archive.org and gets the pages that were originally on the site and then hides the SEO code within the site. Thus the reason dropped domains are so popular.