Monday, November 12, 2007
p0rn.gov - The Ongoing Blackhat SEO Operation
Want pr0n? Try .gov domains in general, ones that have been getting the attention of blackhat SEO-ers for a while, just like the most recent related cases where the City of Chetek, Winsonsin, the City of Somerset, Texas and Town of Norwood, Massachusetts got their blackhat SEO injection. The previous attack is related to the one I'll assess in this post, the blackhat SEO tool is the same given the static subdomains generated, what remains to be answered is how they've managed to get access to the control panels of the domains in order to add the subdomains? Let's look at the facts :
- the targets in this attack are The Virgin Islands Housing Finance Authority (VIHFA), and the City Of Selma, Alabama
- this is the second blackhat SEO operation uncovered during the past couple of months targeting .gov domains
- access to the control panels is somehow obtained so that subdomains pointing to 220.127.116.11 (89-28-13-207.starnet.md) and 18.104.22.168 (89-28-13-195.starnet.md) are added at both domains
- both .gov domains that are targets in this attack are using a shared hosting provider, meaning their IP reputation is in the hands of everyone else's web activities responding under the same IP
- no malware is served in this incident, compared to the previous one, a combination of malware and blackhat SEO
Subdomains at City of Selma currently hosting around 9000 blackhat SEO pages :
Subdomains at the Virgin Islands Housing Finance Authority with constantly changing structure :
Related subdomains now no longer responding :
Where's the connection between this blackhat SEO operation and the previous one? It's not just that both subdomains at the different .gov's are responding to IPs from the same netblock, but also, 22.214.171.124 is responding to City of Somerset's subdomains from the previous incident such as : j6.y.somersettx.gov; st9.x.somersettx.gov; x.somersettx.gov.
Looks like someone in Moldova will get spanked for these incidents.