What kind of black hat method is this?

theblackhat · Jun 8, 2016

I was searching for a random query in google and stumbled upon a url,

Code:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwjM9N_PjpjNAhXDsY8KHadADygQFggcMAA&url=http%3A%2F%2Fwww.bikershighway.in%2F%3Fv%3Dfree-cosmetic-samples&usg=AFQjCNEDRKFHko8YIfCAP4BPy1AfmPJg5A&bvm=bv.124088155,d.c2I

while the actual url just points to,

Code:

http://www.bikershighway.in/?v=free-cosmetic-samples&usg=AFQjCNEDRKFHko8YIfCAP4BPy1AfmPJg5A&bvm=bv.124088155,d.c2I

the redirection happens only when clicked from the g search page. and when you try to load it directly, you see a different pae.

Could someone pls explain what kind of method he is using?

iModBot · Jun 8, 2016

This is google running it through a redirect script so they can collect data on the domain from what search terms people are using to visit this website and other data.

If you right click on any SERP result in google and click copy url you will see this.

theblackhat · Jun 8, 2016

I know SEO said:
This is google running it through a redirect script so they can collect data on the domain from what search terms people are using to visit this website and other data.

If you right click on any SERP result in google and click copy url you will see this.

i'm no expert in blackhat methods, but still it is obviously visible that the guy is using some kind of method there and its not by chance. He knows what he is doing. besides, why would google run through a redirect script..? nope, g never does that!

Darnez123 · Jun 8, 2016

Could it perhaps be it is something that has to do with this? Link.

iModBot · Jun 8, 2016

theblackhat said:
i'm no expert in blackhat methods, but still it is obviously visible that the guy is using some kind of method there and its not by chance. He knows what he is doing. besides, why would google run through a redirect script..? nope, g never does that!

Where did you see the link?

Of course they measure these things, they run it through the script to measure things like click through rates for each result. They monitor everything and this is how they probably collect the data.

Wilson Grant Fisk · Jun 8, 2016

It is either a Hacked site or the guy is using cloaking/doorway pages to send people to the different sites/pages.

0xxi3 · Jun 8, 2016

I know SEO said:
Of course they measure these things, they run it through the script to measure things like click through rates for each result. They monitor everything and this is how they probably collect the data.

It's not that. theblackhat is right, there is something strange going on.
After inspecting HTTP request, I can say following.

All GET requests to http://www.bikershighway.in/ (e.g. /?variable=value) go through /xmlrpc.php file.
I'm unfortunately unfamiliar with XML-RPC, so I'm not sure what's exactly going on there. However, all incoming GET requests where header contains:

Code:

Referer: https://www.google.com/

Will redirect you to some ching-chong webpage that will take you further to wholesale webpage whatever.

TL;DR All users coming from google will get redirected to some third-party website.

theblackhat · Jun 8, 2016

yep.. thats right.. i just inspected in fiddler and it seems there is redirection if the referrer is google. if you paste the url directly, nothing happens.
also, this is the code after first redirection,

Code:

<script src="http://s11.cnzz.com/stat.php?id=1258110290&web_id=1258110290" language="JavaScript"></script>
<script>window.location.href='http://www.9prom.info/google.php';</script>

if you go through the first source, there is a lot of code and im not a coder. I am pretty sure i've seen this method in this forum but completely in a limbo now. definitely there are ppl here who knows whats happening. pls guys, shed some light here

0xxi3 · Jun 8, 2016

I assume this website has been hacked.
It makes very little sense for the owner of the website to do something like that.

Wilson Grant Fisk · Jun 8, 2016

theblackhat said:
yep.. thats right.. i just inspected in fiddler and it seems there is redirection if the referrer is google. if you paste the url directly, nothing happens.
also, this is the code after first redirection,

Code:

<script src="http://s11.cnzz.com/stat.php?id=1258110290&web_id=1258110290" language="JavaScript"></script> <script>window.location.href='http://www.9prom.info/google.php';</script>

if you go through the first source, there is a lot of code and im not a coder. I am pretty sure i've seen this method in this forum but completely in a limbo now. definitely there are ppl here who knows whats happening. pls guys, shed some light here

I posted the answer above the guy is cloaking.

http://lmgtfy.com/?q=seo+cloaking

Check it with this: http://www.seotools.com/seo-cloaking-checker/

whackhat · Jun 8, 2016

I have seen this injected into a hacked magento store, it was a script that stole all referred SE traffic and redirected it out.

disposableher0 · Jun 8, 2016

Like Asif WILSON Khan said, he's either cloaking or someone has hacked htaccess to redirect google traffic to their shitty site

mazilla · Jun 9, 2016

It's not a cloaking. Just hacked website ( through .htaccess file I think) with a doorway

Mr Cool · Jun 9, 2016

it seems like cloaking

drogon · Jun 9, 2016

302 Hijacking. Happened to me earlier this year.

MikeyMikey13 · Jun 10, 2016

drogon said:
302 Hijacking. Happened to me earlier this year.

how did you secure your site to prevent this?

What kind of black hat method is this?

theblackhat

Regular Member

iModBot

Marketplace Team Account

theblackhat

Regular Member

Darnez123

Registered Member

iModBot

Marketplace Team Account

Wilson Grant Fisk

Elite Member

0xxi3

Regular Member

theblackhat

Regular Member

0xxi3

Regular Member

Wilson Grant Fisk

Elite Member

whackhat

Junior Member

disposableher0

Registered Member

mazilla

Junior Member

Mr Cool

Elite Member

drogon

Elite Member

MikeyMikey13

BANNED

Main Menu

Marketplace

Making Money

BlackHat World