Someone is using the site to spam subdomains.
- Thread starter iga2024m
- Start date
moonshine7000
Elite Member
- Mar 4, 2013
- 4,375
- 4,005
The website could be hacked,.Can't say here ,this forum is not a hacking forum and its against the rules
An interesting fact is that this is not the first domain he has created subdomains for. I noticed that all of the domains have the following NS servers
ns77.worldnic.com
ns78.worldnic.com
There may be a vulnerability on this hosting service that allows subdomains to be created. The website https://mayfieldclinic.com/ has https, but the subdomains for spam are created on http.
ns77.worldnic.com
ns78.worldnic.com
There may be a vulnerability on this hosting service that allows subdomains to be created. The website https://mayfieldclinic.com/ has https, but the subdomains for spam are created on http.
moonshine7000
Elite Member
- Mar 4, 2013
- 4,375
- 4,005
yeh using the subdomain to do parasite seo but in another language
- Feb 28, 2019
- 7,455
- 7,915
This is called subdomain takeover and is extremely common unlike what most people think. Considering that creating a subdomain such as kink is less probable, the site might be hacked.
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
This kind of attack is known as "Symlink race" or "Symlink Attack". Web.com (AKA Network Solutions) is vulnerable to such.
Wikipedia Symlink Race: Symlink Race
PDF Paper: HACKING EXPOSED: NETWORK SECURITY SECRETS & SOLUTIONS SECOND EDITION
Wikipedia Symlink Race: Symlink Race
PDF Paper: HACKING EXPOSED: NETWORK SECURITY SECRETS & SOLUTIONS SECOND EDITION
GermanCPA
Junior Member
- Mar 31, 2025
- 167
- 110
So much nonsense.
The question is if the subdomain is actually getting "juice" from the main domain or is treated as completely new domain.
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
That was NEVER the question. The questions were:
- How is this done?
- How can it be prevented?
You should know that Google treats subdomains as separate entities from the main domain. This means a subdomain's search rankings, authority, and "juice" are not directly inherited from the root domain. John Mueller, a Search Advocate at Google: "Google doesn't treat subdomains differently than subdirectories for crawling or indexing purposes. However, the systems that determine ranking do. They treat them as separate sites."
If you need more elementary information about this, check out this video, it may help you to understand this better:
GermanCPA
Junior Member
- Mar 31, 2025
- 167
- 110
I know how it is "done" and it has nothing to do with what you wrote about "symlink race".
If that is the case, why would anyone use these subdomains? And then get them all indexed?
The video you posted is from - buckle up - 12 years ago. So, I have doubts. Seems like one of the myths posted and then continuously repeated over and over.
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
I have done this before using Symlink race, and I know for a fact that Network Solutions is vulnerable to such.
Answering your question:
If that is the case, why would anyone use these subdomains? And then get them all indexed?
While the video I referenced was older, its core message remains relevant. Google does indeed treat a subdomain as a separate site.
The attacker's goal is to leverage the main domain's authority. While Google treats subdomains as separate sites, a strong root domain can sometimes help new subdomains get indexed quickly. The attacker is essentially "parasitizing" the trust and authority of the compromised main domain to get their spam content into Google's index.
By creating thousands of subdomains, the attacker is essentially playing a numbers game. They publish spam content across a huge number of subdomains, hoping a percentage of it will get indexed and rank for various search queries.
The goal is to drive traffic to these spam pages, often for affiliate marketing, phishing, or other malicious purposes.
Therefore, the symlink race attack was the method used to compromise the server, and the creation of spam subdomains was the result of that compromise an SEO-based attack designed to get thousands of junk pages indexed by Google.
GermanCPA
Junior Member
- Mar 31, 2025
- 167
- 110
contradicting ->
So, yeah, exactly. It's inconclusive if subdomains aren't getting the authority from the root domain.
Also, since you are contradicting yourself... I checked your messages:
Bro, stop that. It's not "symlink race" or whatever buzz word you want use.
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
1.- You don't know what Symlink race is. That let me know you haven't checked the resources shared in here or you didn't understand that. This is not a "buzz word.
2.- I don't see the contradiction. The attacker is using the root domain authority to index the spammy subdomains. That's it. The "authority juice" is just to INDEX them.
3.- To give you a clear example:
When you make a new account at wordpress.com, you get a subdomain like youraccount.wordpress.com. The benefit or SEO juice you get from wordpress.com to your account? None. It will help you to index the new link in Google, but your domain authority will be 0.
GermanCPA
Junior Member
- Mar 31, 2025
- 167
- 110
So the root domain gives power to the subdomain.
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
The root domain will tell G to index the entry of the subdomain. But that's nothing related to "power".
How do I know this is a symlink race attack? If you saw the screenshot shared by @iga2024m and me, you'd see the exact same date on the files uploaded to kink.mayfieldclinic. That date format is a distinct indicator of an uploaded file, not a newly created one.
This is visible if you search for the same "print" in other compromised websites.
GermanCPA
Junior Member
- Mar 31, 2025
- 167
- 110
How would Google even know that the subdomain exists if it's not "indicated" somewhere. What does that have to do with the root domain?
I don't know how this date besides the url in Google search results shows up, but there can be absolutely no conclusion be made that this is because of "uploading". And hacking a domain can be made by a number of ways and "symlink races" is just a nonsense buzz word. More likely it's just a Wordpress vulnerability or xss or sqli gaining access to a panel (like cPanel).
syslay288
Regular Member
- Apr 2, 2013
- 384
- 230
