6 ms·

Also, we turned up 2,000 domains that redirect to a very shady site called happyfamilymedstore[dot]com. Stuff like avanafill[dot]com, pfzviagra[dot]com, prednis

Also, we turned up 2,000 domains that redirect to a very shady site called happyfamilymedstore[dot]com. Stuff like avanafill[dot]com, pfzviagra[dot]com, prednisoloneotc[dot]com. These domains made it into the Tranco 100k somehow. Full list here - https://gist.github.com/gurgeous/bcb3e851087763efe4b2f4b992f1b842 https://gist.github.com/gurgeous/bcb3e851087763efe4b2f4b992f...

unicornporn 5y ago
Lately, happyfamilymedstore has mysteriously always been in the top ~ten Google Images results for super niche bicycle parts searches I do. They seem to have ripped an insane amount if images that gets reposted on their domain.
- 0des 5y ago
  What kind of parts are you looking for?
noitpmeder 5y ago
Does anyone know the story behind these? How do seemingly obscure sites consistently get massive amount of obscure content placed highly in results.
- IncRnd 5y ago
  It happens through search engine optimization, SEO, and a mix of planting reviews and other tactics. Think of it like this - what would you do to get people talking about your site? You'd somehow put links, conversations, reviews, quotes, etc. in front of them.
- jacurtis 5y ago
  What most of them do is they will use Wordpress exploits to get into random wordpress website ran by people who know nothing about managing a website and are running on a $3/mo shared hosting account. After they get into these random wordpress sites, then then embed links back to their sketchy site in obscure places on the wordpress site that they hacked, so that owners of the site don't notice, but search bots do. They usually leave the wordpress site alone, but will create a user account to get back into it again later if Wordpress patches an exploit. All of this exploit and link adding is automated, so it is just done by crawlers and bots. This is done tens of thousands or even millions of times over. All of these sketchy backlinks eventually add up, even if they are low quality, and provide higher ranking for the site they all point to. Think of websites like mommy blogs, diet diaries, family sites, personal blogs, and random service companies (plumbers, pest control, restaurants, etc) that had their nephew throw up a wordpress site instead of hiring a professional. I don't mean to pick on wordpress, but it really is the most common culprit of these attacks. Because so many Wordpress sites exist that are operated by people who aren't informed about basic security. Plus, wordpress is open source, so exploits get discovered by looking at source code and attackers will sell those exploits instead of reporting them. So Wordpress is in an infinite cycle of chasing exploits and patching them.
  - mfkp 5y ago
    I recently saw and reported one to a local business. If you typed in the domain and visited directly, it wouldn't redirect to the scam site. But if you clicked on a link from a google search, then it would redirect. Probably makes it harder to find for small website owners if they're not clicking their own google searches.
  - lazide 5y ago
    Pretty sure closed source wasn’t very effective at stopping 0days either (Windows). The most common platform gets the attention generally.
  - shuntress 5y ago
    > "had their nephew throw up a wordpress site instead of hiring a professional" The web is supposed to be accessible to everyone. This type of "blame the victim" attitude is a poor way to handle criminal activity.
    - jiggawatts 5y ago
      If they had used static content, it would remain 100% accessible to them, but also vastly more secure. Dynamic content generation on the fly for a blog is unnecessary complexity that invites attacks.
      - jiggunjer 5y ago
        wouldn't that preclude a few popular features like a rich text editor?
        jiggawatts 5y ago
        You can have a separate system, even a locally running desktop app do that. You can still have a database, complex HTML templating, and image resizing! You just do it offline as a preprocessing step instead of online dynamically for each page view. Unfortunately, this approach never took off, even though it scales trivially to enormous sites and traffic levels. I recently tried to optimise a CMS system where it was streaming photos from the database to the web tier, which then resized it and even optimised it on the fly. Even with caching, the overheads were just obscene. Over a 100 cores could barely push out 200 Mbps of content. Meanwhile a single-core VM can easily do 1 Gbps of static content!
johnx123-up 5y ago
IMHO, you should add this note in the blog too. Also, wondering about the use case of the website... are you building anything else too?

unicornporn 5y ago

Lately, happyfamilymedstore has mysteriously always been in the top ~ten Google Images results for super niche bicycle parts searches I do. They seem to have ripped an insane amount if images that gets reposted on their domain.

0des 5y ago
What kind of parts are you looking for?

noitpmeder 5y ago

Does anyone know the story behind these? How do seemingly obscure sites consistently get massive amount of obscure content placed highly in results.

IncRnd 5y ago
It happens through search engine optimization, SEO, and a mix of planting reviews and other tactics. Think of it like this - what would you do to get people talking about your site? You'd somehow put links, conversations, reviews, quotes, etc. in front of them.
jacurtis 5y ago
What most of them do is they will use Wordpress exploits to get into random wordpress website ran by people who know nothing about managing a website and are running on a $3/mo shared hosting account. After they get into these random wordpress sites, then then embed links back to their sketchy site in obscure places on the wordpress site that they hacked, so that owners of the site don't notice, but search bots do. They usually leave the wordpress site alone, but will create a user account to get back into it again later if Wordpress patches an exploit. All of this exploit and link adding is automated, so it is just done by crawlers and bots. This is done tens of thousands or even millions of times over. All of these sketchy backlinks eventually add up, even if they are low quality, and provide higher ranking for the site they all point to. Think of websites like mommy blogs, diet diaries, family sites, personal blogs, and random service companies (plumbers, pest control, restaurants, etc) that had their nephew throw up a wordpress site instead of hiring a professional. I don't mean to pick on wordpress, but it really is the most common culprit of these attacks. Because so many Wordpress sites exist that are operated by people who aren't informed about basic security. Plus, wordpress is open source, so exploits get discovered by looking at source code and attackers will sell those exploits instead of reporting them. So Wordpress is in an infinite cycle of chasing exploits and patching them.
- mfkp 5y ago
  I recently saw and reported one to a local business. If you typed in the domain and visited directly, it wouldn't redirect to the scam site. But if you clicked on a link from a google search, then it would redirect. Probably makes it harder to find for small website owners if they're not clicking their own google searches.
- lazide 5y ago
  Pretty sure closed source wasn’t very effective at stopping 0days either (Windows). The most common platform gets the attention generally.
- shuntress 5y ago
  > "had their nephew throw up a wordpress site instead of hiring a professional" The web is supposed to be accessible to everyone. This type of "blame the victim" attitude is a poor way to handle criminal activity.
  - jiggawatts 5y ago
    If they had used static content, it would remain 100% accessible to them, but also vastly more secure. Dynamic content generation on the fly for a blog is unnecessary complexity that invites attacks.
    - jiggunjer 5y ago
      wouldn't that preclude a few popular features like a rich text editor?
      - jiggawatts 5y ago
        You can have a separate system, even a locally running desktop app do that. You can still have a database, complex HTML templating, and image resizing! You just do it offline as a preprocessing step instead of online dynamically for each page view. Unfortunately, this approach never took off, even though it scales trivially to enormous sites and traffic levels. I recently tried to optimise a CMS system where it was streaming photos from the database to the web tier, which then resized it and even optimised it on the fly. Even with caching, the overheads were just obscene. Over a 100 cores could barely push out 200 Mbps of content. Meanwhile a single-core VM can easily do 1 Gbps of static content!

johnx123-up 5y ago

IMHO, you should add this note in the blog too. Also, wondering about the use case of the website... are you building anything else too?