4 ms·
These looked like cached search results. I am not seeing the IOCs on the live site unless I am missing it or they're only showing them to googlebots. One can s
by batch12 2y ago
These looked like cached search results. I am not seeing the IOCs on the live site unless I am missing it or they're only showing them to googlebots.
One can see the results by searching google for the domain and the "gold" string from the article.
- internetter 2y agoClicking the link from the google search results continues to work, I just tested it on my phone. Visiting the page directly continues to redirect for me
- wil421 2y agoIf you think the site is still serving the redirects I’m going to make a phone call to a publicly available number of some Cyber Crime division for Georgia’s GBI.
- internetter 2y agoTest it yourself: https://www.google.com/search?q=team.georgia.gov+%22kamagra%22 https://www.google.com/search?q=team.georgia.gov+%22kamagra%...
- mdorazio 2y agoI tried the first 5 links and none of them showed the hacked content in the resulting page. At least for me the Google results were all old caches.
- internetter 2y agoCould you try setting the referrer to google.com in the WGET? https://shottr.cc/s/1CXn/SCR-20240426-cm4.png https://shottr.cc/s/1CXn/SCR-20240426-cm4.png
- ldoughty 2y agoNote that browsers/extensions/settings that hide your referrer might prevent you from encountering this redirect
- qingcharles 2y agoWorked for me with no changing of any referrer or other HTTP settings. Clicking on the first georgia.gov resulted redirected me to the spam site. (Win11 + Chrome)
- Symbiote 2y agoFrom the screenshot linked above: curl -i -H 'Referer: google.com' https://team.georgia.gov/medicicnes/kamagra-gold-100/ HTTP/1.1 301 Moved Permanently Date: Fri, 26 Apr 2024 12:36:14 GMT Server: Apache/2.4.6 (CentOS) X-Powered-By: PHP/7.4.33 Location: https://gomylink.site/vkKXXr8G?sub1=kamagra-gold-100&sub2=team.georgia.gov Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
- batch12 2y agoGood find- I was on my mobile at the time so couldn't dig this deep so I am happy to see someone figured it out.
- internetter 2y agoThank you for bringing this up! The plot thickens: https://shottr.cc/s/1CXn/SCR-20240426-cm4.png https://shottr.cc/s/1CXn/SCR-20240426-cm4.png
- ceejayoz 2y agoThis is why it's fairly common for people to say "Google says my site is hacked, but when I check it's fine!" on webdev forums.
- eli 2y agoThis is standard practice for hacked wordpress sites. They only serve the compromise to organic search traffic.
- ljp_206 2y agoYes, I have heard this called a link cloaking hack, methinks.