Analyzing 17,000 Spam Links on a Hacked WordPress Site

We have been analyzing how bad actors attack WordPress, and what they do after they take control of a website. In our most recent article we watched as they modified a functions file for the active theme and injected it with 17,000 SEO links.

This article dives into those 17,000 links to see what they are and what we can learn from them.

**Updated: 2022-08-24: Include a more direct list of all articles related to this research:

  1. Part 1: How WordPress Gets Hacked in 2022 – Initial Reconnaissance
  2. Part 2: What Hackers Do with WordPress in 2022 – Post Hack Analysis
  3. Part 3: Analyzing 17,000 Spam Links on a Hacked WordPress Site
  4. Part 4: Hijacking a Websites SERP Results with SEO SPAM
  5. Part 5: Navigating 81 Layers of Encoding to Reveal the C&C

At first glance, it appears that the they are trying to trick Google into identifying cornerstone content on these domains by highlighting key words.

But what makes it really weird is that when you visit the hacked websites they are all Casino pages:

At first we were hoping that these were all malicious domains, but it turns out that a majority of them are websites that have been hacked. It also looks as if while they inserted 17k entries, there were only 16 unique domains (each listed 1,000 times exactly), and 1 IP.

DomainLocationInstances
54.255.191.213Amazon EC21,000
bvespirita[.]comCloudFlare1,000
cgivancouver[.]orgCloudFlare1,000
smtp.tularesuperiorcourt[.]ca[.]gov/slot-gacor/Pantheon1,000
triple5bet[.]comCloudFlare1,000
victory[.]osu[.]eduPantheon1,000
web[.]rcepsec[.]org/situs-slot-bonus-100-di-depan/CloudHost1,000
dougrickard[.]comCloudFlare1,000
www[.]mishottowin[.]com/slot888/CloudFlare1,000
www[.]mpwarehousing[.]comCloudFlare1,000
www[.respectproject[.]orgCloudFlare1,000
www[.]spacelaunchreport[.]comCloudFlare1,000
www[.]studentuk[.]comCloudFlare1,000
www[.]traumaticbraininjuryatoz[.]orgCloudFlare1,000
www[.]ullswater[.]comCloudFlare1,000
www[.]urbanedjournal[.]orgCloudFlare1,000
www[.]worldanimalfoundation[.]comCloudFlare1,000

Coincidently, 76.5% of the domains were sitting behind CloudFlare. But you can’t extrapolate too much from that, they are Free CDN service and for years bad actors have used them to keep their properties up.

But, that does bring me to a different point. With exception to the IP, and triple5bet[.]com, all other domains seemed to come from organizations that had their website hacked in the past 30 – 45 days (according to archive.org).

In one instance, one domain holder gave up their main TLD and switched to another one (.com -> .org). We can’t tell if this was as a response to the hack, and just starting over, or maybe a domain expiring. Being that it’s an organization, however, they would have been able to win an argument with a registrar, so we’re leaning towards it being an easy fix to use a different TLD.

We also noticed other variations where pages were added to the main domains, leaving the main site in tact. Most likely intended to reduce the risk of being detected.

This brings us full circle to what they were trying to do with all these link injections.

Our best bet is they were trying to capitalize on key words that are ranking really high right now and directing them to these sites through the art of link backs and cornerstone content. What better keywords to target than porn, and porno, which makes up a dramatic amount of online traffic.

Needless to say, this type of injection is bound to get your website blacklisted by Google and other search engines.