We have been analyzing how bad actors attack WordPress, and what they do after they take control of a website. In our most recent article we watched as they modified a functions file for the active theme and injected it with 17,000 SEO links.
This article dives into those 17,000 links to see what they are and what we can learn from them.
**Updated: 2022-08-24: Include a more direct list of all articles related to this research:
At first glance, it appears that the they are trying to trick Google into identifying cornerstone content on these domains by highlighting key words.
But what makes it really weird is that when you visit the hacked websites they are all Casino pages:
At first we were hoping that these were all malicious domains, but it turns out that a majority of them are websites that have been hacked. It also looks as if while they inserted 17k entries, there were only 16 unique domains (each listed 1,000 times exactly), and 1 IP.
|Domain||Location||# of Instances|
Coincidently, 76.5% of the domains were sitting behind CloudFlare. But you can't extrapolate too much from that, they are Free CDN service and for years bad actors have used them to keep their properties up.
But, that does bring me to a different point. With exception to the IP, and triple5bet[.]com, all other domains seemed to come from organizations that had their website hacked in the past 30 - 45 days (according to archive.org).
In one instance, one domain holder gave up their main TLD and switched to another one (.com -> .org). We can't tell if this was as a response to the hack, and just starting over, or maybe a domain expiring. Being that it's an organization, however, they would have been able to win an argument with a registrar, so we're leaning towards it being an easy fix to use a different TLD.
We also noticed other variations where pages were added to the main domains, leaving the main site in tact. Most likely intended to reduce the risk of being detected.
This brings us full circle to what they were trying to do with all these link injections.
Our best bet is they were trying to capitalize on key words that are ranking really high right now and directing them to these sites through the art of link backs and cornerstone content. What better keywords to target than porn, and porno, which makes up a dramatic amount of online traffic.
Needless to say, this type of injection is bound to get your website blacklisted by Google and other search engines.