Blackhat SEO Spammer targeting High PR WordPress Blog

Avice De'veréux — Thu, 14 Feb 2008 20:14:48 +0000

I’ve been monitoring mattheaton.com “wordpress.net.in goro spam injections” for this past few months. Noticeably, the blackhat spamming method is changing dramatically. For those who are still unaware of Wordpress Goro Spam please read my earlier post → Wordpress.net.in Spam injection& Gaming Bluehost & Hostmonster CEO’s Blog.

thinkingphp.org (PR6) & jensfrake.com (PR7) has been hijacked by “Wordpress Blackhat SEO Spammer” for this month. Both sites were running on WordPress 2.3.2.

By now the

signature has been replaced with “Inline CSS” wrapper.

Cloacking Check on Mattheaton.com

Normal Browser: 32,246 characters - mattheaton-com-source.txt
Google bot: 34,646 characters - mattheaton-com-googlebot-source.txt
Difference: 2,400 characters

Cloacking Check on jensfrake.com & blog.jensfrake.com

Normal Browser: 59,580 characters - blogjensfrakecom.txt
Google bot: 59,699 characters - blogjensfrakecom-googlebot.txt
Difference: 119 characters

While scanning jensfrake.com their server return 400-500 error, so we had to scan his (clone) subdomain blog.jensfrake.com instead of the main site

This time around, you wont see the spam on both of this website, all the spam links is position out of the client view-port (top -3337px, left -2227px).

another mathematical jokes, l33t.

What’s new with Goro spam 2008

WordPress <= 2.3.2 is vulnerable to this attack.
Inject Spamlinks wrap with extra Inline CSS for cloacking
Target High PR Sites → PR5 and above

External Links

National Vulnerabilities Database (NVD) on Wordpress 2.0 > 2.0.5 vulnerabilities

The Web Standard Group - ACID2 Test page Failed W3C CSS Validation

Nick B — Sat, 22 Dec 2007 14:53:25 +0000

I’m following up recent announcements on IEBLOG Internet Explorer 8 and Acid2: A Milestone. To my surprise, the Web Standard Groups ACID2 Test Page doesn’t conform to W3C CSS Validation.

The Errors

9 errors & 31 warnings.

Sorry! We found the following errors
43 	 Parse Error - second two]
88 	.parser-container div 	Value Error : color orange is not a color value : orange
94 	.parser 	Property error doesn't exist : }
97 	.parser 	Property m rgin doesn't exist : 2em
97 	Parse error - Unrecognized };
99 	.parser 	Value Error : width only 0 can be a length. You must put an unit after your number : 200
100 	.parser 	Value Error : border Lexical error at line 96, column 38. Encountered: "e" (101), after : "! "error;
100 	.parser 	Value Error : border Parse error - Unrecognized }
101 	.parser 	Value Error : background Too many values or values are not recognized : red pink

W3c CSS Validation → http://www.webstandards.org/files/acid2/test.html

Full page Screenshot

Update: Just got ping from chaoskaizer. She said the CSS ERROR is part of the Web Standards Test Suit.

Kakkoi » owned