Page 1 of 2 12 LastLast
Results 1 to 20 of 22
  1. #1
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default Hacker and/or Black Hatter

    I've recently seen some interesting websites showing up in the search results on google.ca. I first noticed them because of the domain names, and found that most of them were the exact same website, all ranking on the first couple pages for keywords like "online casinos" and "online casinos canada".

    All the sites are exacltly the same as this one (the url is included in the footer of all the other websites so it was easy to find):
    best-canada-casinos.com

    Here are some of the domains with the exact same website that are ranking well:
    www.beaverlodgevictimservices.ca
    dalsailing.ca
    motherbynature.ca
    Ontario Environment Network - www.oen.ca

    If you look at the preview images in google, it shows all of those websites have recently been changed to the casino portal (copied and pasted exactly), because at the time the preview image was taken, those websites were about what the domain said they were about.

    They had this website (based on this google search result), but it looks like the owners got it back:
    Online Casino | Best Online Canadian Casino Reviews
    www.communityofchrist.ca
    Discover how we rate and review Canadian online casino sites so players always get the best deals.

    At first I thought those were just old domains that someone bought and changed to casino portals, but seeing that communityofchrist.ca search result and finding the website actually being about Christ, made me think it was probably hacked and recently recovered.

    Slightly different but obviously the same person, targeting USA: online-casino-rws.com

    I'm sure Google will deal them soon, but I wanted to report this to everyone here.

  2. The Following 2 Users Say Thank You to TheCanadianGambler For This Useful Post:

    lots0 (4 March 2013), TheGamblingGuru (4 March 2013)

  3. #2
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Wow, so after going through all that, I checked and those websites are back to normal, so there is no evidence to show you any more (other than them still being in the search results with the casino portal titles and descriptions).

  4. #3
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Here is a picture of the search results.

    Name:  strangesearchresults2.jpg
Views: 638
Size:  316.3 KB

    satellitedishcanada.com is also back to being about satellite dishes, but it wasn't the exact same casino portal as the others in my first post so I didn't include it.

    laurier100.ca is supposed to be about a university, but it has a virus on it so I didn't actually make it in to see the site.

  5. #4
    lots0 is offline Former Public Member
    Join Date
    November 2003
    Posts
    886
    Blog Entries
    1
    Thanks
    299
    Thanked 571 Times in 251 Posts

    Default

    Have you checked your end for browser re-directs or some other type of malware?

  6. #5
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Yep, all clear here. That wouldn't explain why those websites are showing up in the SERPs like they are either.

  7. #6
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    So I was doing some more thinking, trying to figure out exactly what was going on, and why it would get fixed right after I posted about it. It's not fixed, it just doesn't happen when going directly to the websites.

    Going directly to the websites I listed will take me to the regular website, but when I click on them from google, it goes to that best-canada-casinos.com.

    Clicking on any other link from google takes me to the site that it's supposed to.

    The top result, www.satellitedishcanada.com, re-directs me to www.satellitedisncanada.com where the 'h' has been changed to an 'n' to make it look similar.

    It's somehow re-directing me, but only when I click from Google, and only those sites that look like they don't belong on the first page (based on the domain names).

    Can someone please try this Google.ca search result link and see if you are getting the same thing?

    I tried it on a couple computers and my laptop, both IE and Firefox.

    Edited to add: If it's taking you to the proper websites, try using Private browsing.
    Last edited by TheCanadianGambler; 4 March 2013 at 9:02 pm.

  8. #7
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Sorry for the multiple posts, but I've figured it out after some testing.

    I tried this in Google and Bing.

    Do a search for Satellite Dish Canada, click on www.satellitedishcanada.com, it will take you to the proper site.

    Do a search for Satellite Dish Canada Casino, click on www.satellitedishcanada.com, it will take you to a casino portal.

    The triggers for the re-directs are search engine traffic with the word 'casino' or 'casinos' in the search.

    Now, is this a hacker or the site owners using black hat seo? The fact that the several (seemingly unrelated) sites I listed in the first post re-direct to the same casino portal, makes me think the sites have been hacked... but satellitedishcanada.com is different, it has the casino portal title and description on the proper site while the others don't, and the casino portal has different affy tags on the links.

    Either way, these websites should not be dominating the first page for these keywords/phrases. If these sites are hacked, the owners may not even know since they are only losing search traffic with the word casino in it. Very sneaky and underhanded.

  9. #8
    Razbet's Avatar
    Razbet is offline Private Member
    Join Date
    January 2013
    Location
    Canada
    Posts
    24
    Thanks
    0
    Thanked 5 Times in 5 Posts

    Default

    Typical black hat stuff ....
    But I don't understand how come Google is not catching this stuff faster ...

  10. #9
    F-L-C is offline Private Member
    Join Date
    August 2010
    Posts
    1,048
    Thanks
    141
    Thanked 332 Times in 254 Posts

  11. The Following User Says Thank You to F-L-C For This Useful Post:

    -Shay- (5 March 2013)

  12. #10
    -Shay- is offline Public Member
    Join Date
    November 2012
    Posts
    3,062
    Thanks
    12,211
    Thanked 3,135 Times in 1,686 Posts

    Default

    Google has a ton of $hit in their search results at present. Would love to see a round of refreshes out of them to get rid of the spam & crap floating around.

  13. #11
    DaftDog's Avatar
    DaftDog is offline Private Member
    Join Date
    October 2008
    Posts
    1,892
    Thanks
    533
    Thanked 659 Times in 379 Posts

    Default

    I experienced something similar in August 2012 and posted here: https://www.gpwa.org/forum/wtf-black...ht=#post697191

    The xxhttp://www.weberik.com site has since become a one word, one page site that simply says "hello".

  14. #12
    lowrisk is offline Private Member
    Join Date
    June 2011
    Posts
    801
    Thanks
    80
    Thanked 180 Times in 132 Posts

    Default

    I wouldn't worry too much, things like this never last, Google will get wise to it eventually.

  15. #13
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Quote Originally Posted by Ixian View Post
    I experienced something similar in August 2012 and posted here: https://www.gpwa.org/forum/wtf-black...ht=#post697191

    The xxhttp://www.weberik.com site has since become a one word, one page site that simply says "hello".
    These redirects also appear to be geo-targeted to Canada.

  16. #14
    universal4's Avatar
    universal4 is offline Forum Administrator
    Join Date
    July 2003
    Location
    Courage is being scared to death...and saddling up anyway. John Wayne
    Posts
    28,013
    Thanks
    2,222
    Thanked 7,917 Times in 4,993 Posts

    Default

    Have you tried this on a different system?

    Go to a friends house and try it on a different computer to see if the results are the same.

    Not sure why the person that owns the satellite website would want to lie in his title about what the site is about.

    Rick
    Universal4
    Gambling World Online Roulette Online Blackjack Live Online Games Sports Betting Horse Racing
    Casino Affiliate Programs
    Hosting and Domain Names
    Gambling Industry Association
    GPWA Moderation by Me and My Big Bad Security Self
    If an affiliate program is not small affiliate friendly (especially small US Affiliate), then they are NOT Affiliate Friendly!

  17. #15
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Quote Originally Posted by universal4 View Post
    Have you tried this on a different system?

    Go to a friends house and try it on a different computer to see if the results are the same.

    Not sure why the person that owns the satellite website would want to lie in his title about what the site is about.

    Rick
    Universal4
    Yep that was one of the first things I did, called a few family members to try it out... it didn't occur to me that they were also all in Canada. They got the same search results, and the same redirects. I know it doesn't work for people in the US, so it must be geo-targeted.

    Actually if you read the first part of the satellite website, it says they'll "give every 10th customer bonus codes of Canada's largest online casinos." So it looks like they are doing it on purpose.

  18. #16
    lots0 is offline Former Public Member
    Join Date
    November 2003
    Posts
    886
    Blog Entries
    1
    Thanks
    299
    Thanked 571 Times in 251 Posts

    Default

    I was just checking this out using a Canadian Proxy.

    I still don't see the same results as what your getting.

    Just out of curiosity have you ran any anti-maleware programs like Spybot recently?

    I know you don't think your infected, because your family is getting the same results.. But it is entirely possible that your entire family's computers are infected, most malware will travel within in your circle of friends and family... as your communicating with them your passing the malware around.

  19. #17
    universal4's Avatar
    universal4 is offline Forum Administrator
    Join Date
    July 2003
    Location
    Courage is being scared to death...and saddling up anyway. John Wayne
    Posts
    28,013
    Thanks
    2,222
    Thanked 7,917 Times in 4,993 Posts

    Default

    Actually if you read the first part of the satellite website, it says they'll "give every 10th customer bonus codes of Canada's largest online casinos." So it looks like they are doing it on purpose.
    No doubt they are doing it on purpose, but it is still kinda dumb and the casino terms will not win them many if any satellite customers, and I would think if I were planning to buy one, I would want to deal with a vendor or reseller that knew the difference between casinos and satellites.

    And I rarely research casinos on satellite websites.

    I have not tried this search using a proxy, so not sure the results are specific to Canada, but it also could be specific to an isp.

    Rick
    Universal4
    Gambling World Online Roulette Online Blackjack Live Online Games Sports Betting Horse Racing
    Casino Affiliate Programs
    Hosting and Domain Names
    Gambling Industry Association
    GPWA Moderation by Me and My Big Bad Security Self
    If an affiliate program is not small affiliate friendly (especially small US Affiliate), then they are NOT Affiliate Friendly!

  20. #18
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    Quote Originally Posted by lots0 View Post
    Just out of curiosity have you ran any anti-maleware programs like Spybot recently?
    Yes, and just to double check I ran a full scan with MalwareBytes (not just a quick scan) and a boot-time anti-virus scan.

  21. #19
    dfiocch's Avatar
    dfiocch is offline Private Member
    Join Date
    September 2006
    Posts
    878
    Thanks
    789
    Thanked 567 Times in 350 Posts

    Default

    Blackhatters.

    I see this also in other G domains (.it, .co.uk etc).

  22. #20
    TheCanadianGambler's Avatar
    TheCanadianGambler is offline Private Member
    Join Date
    September 2010
    Location
    Canada
    Posts
    161
    Thanks
    72
    Thanked 78 Times in 44 Posts

    Default

    This issue is becoming widespread and people are starting to notice. I never heard anything back from Google (not sure if anyone ever does), and the most I heard from the affy programs with casinos being promoted on those sites, is that they are "looking into it".

    There is a 6 page thread about it on the Casinomeister forums: http://www.casinomeister.com/forums/...e-casinos.html

    The satellite dish site domain is now casinotop.ca, it redirects when you copy and paste satellitedishcanada.com link directly to your browser. It's still a site about satellite dishes until you trigger the redirect through a search engine, and even if you paste casinotop.ca in your browser, it will show the satellite website.

    Now that the domain has changed, they no longer show up in searches for satellite dishes, but they're probably making a whole lot more money being the #1 result for 'online casinos' on google.ca.

    Makes me sick thinking about the potential profit of being number 1 for that term for so long. If you get there legitimately, all the power to you. If you get there by cheating, I hope Karma comes around and kicks your ass real good.

    If you are an affiliate manager of program with a casino listed on these websites, please do not pay these affiliates. It's the only way to punish these people and discourage this behaviour... behaviour which is detrimental to your own casinos and the entire industry.

  23. The Following User Says Thank You to TheCanadianGambler For This Useful Post:

    dfiocch (18 April 2013)

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •