I’ve been monitoring mattheaton.com “wordpress.net.in goro spam injections” for this past few months. Noticeably, the blackhat spamming method is changing dramatically. For those who are still unaware of Wordpress Goro Spam please read my earlier post → Wordpress.net.in Spam injection& Gaming Bluehost & Hostmonster CEO’s Blog.
thinkingphp.org (PR6) & jensfrake.com (PR7) has been hijacked by “Wordpress Blackhat SEO Spammer” for this month. Both sites were running on WordPress 2.3.2.
By now the <div id=”goro”> signature has been replaced with “Inline CSS” wrapper.
I’m quite surprise to see my server logs todays, Some dude decide to scrap my blog content (including my wp translations cache 100mb+ )
The Offending uri: http://www.shouker.com/user1/baiheinet/2008/1/16/80897.html
I’d blocked the site but it wont stop the search engine crawler from indexing the content .
This is nasty Blackhat SEO methods to get the target website penalize for duplicate content on Major Search Engine. There is few solution that i found at various resources ↓.
(more…)
Being Hacked by SEO spammer is seem like a yearly events at Mattheaton.com. Matt’s WordPress blog was first hijacked 2 months ago on 26 November 2007 (according to my record). You can digg my earlier post at → Matt Heaton BlueHost HostMonster CEO Official Blog Hacked.
It’s a big embarrassment for bluehost & hostmonster hosting to have their CEO’s blog being spamride every year (since 2007) . Drilling Matt Heaton’s with bad ads wont solves the Blackhat Spam issues, I will left that particulars part to my readers to speculate.
Dec 11 2007 - Matt Heaton Blog’s has been cleansed. ATM he’s using latest version of WordPress (2.3.x). And also most of the blogs lists in this articles has been upgrade.
Jan 26th, 2008 - Seem like bluehost engineer did a bad job at cleaning, the goro spam is back.
Just after the recent issue on wordpress.com.cn now there is new wordpress imitater. A remote spamware injection by wordpress.net.in
I was reading one of Matt Heaton posted 2 days ago when I found bunch of spamsware link on his wordpress footer.
Matt’s is using default wodpress theme (kubrick) with single javascript for adsense. The only way the spams can get in is probably via php injection or by manual editing. All the spamware is redirect to howardowens.com/?order=XX page.
The below diagram explained the lookup results for howardowens.com. click on the image to enlarge.
![]()
Surprisingly the spammer website is also host by bluehost.com (69.89.16.0/20,74.220.192.0/19 ,69.89.16.4 -> box183.bluehost.com).
Just google for “warez full apps”, most of results sites has PR6. I don’t like to put any name here so do your own research and go ask Matt’s for good answered. If you arent satisfied with this issue I suggest you open Google Webmaster accounts and submit those site for reviews/sandbox.
After the recent controversy over payperpost and linkexchange policy. What do you think of PR over this issue? Do you care about SEO?.