Advertising Script Exploit
-
I recently found a script in the root of my wordpress blog that I believe came from a plugin, but I’m not sure which one yet. The script, which was named ph.php generated thousands of links in the format /blog/ph.php?12345 that redirected to pharmacy advertising pages.
I found it quickly and removed it. I then had to remove a couple of thousand links from Googles index and cleanup the mess. I’ve just found that this is a two part exploit. There are literally thousands of WordPress blogs that, when a page is served, have hundreds of hidden links that point to the links generated by the script that, on my installation, was named ph.php.
Here are a couple of links I picked at random. View the source and scroll down, you’ll see hundreds of hidden links at the bottom;
https://autoinsurancestories.com/?s=stories
https://blog.debbieferrari.com/index.php?s=remodel
https://blog.sandrasays.com/index.php?s=tangerineFor each link generated /blog/ph.php?12345 there are about 6,500 links to each one from infected blogs.
This is a serious problem. My search engine ranking plummetted as all of the traffic became pharma related spam. Have you seen this and do you want to help me track it down and make others aware of it.
Your help is greatly appreciated
Steve Tickner
- The topic ‘Advertising Script Exploit’ is closed to new replies.