Today, out of the blue, something really weird started happening in a couple of student Weblogs. The kids created the posts and entered titles leaving blank the URL lines which link the titles to somewhere. But we discovered that on three posts, the titles mysteriously got linked to here, here and here, all sites that list links to porno type places. Funny thing is when you click on any of those links, they just take you to more pages of links that look the same. No pictures, but lots of bad words.
Both kids deny doing it, and the teachers tend to believe them. I tend to believe them simply because the sites look so similar, and I would guess that dubrovia.net would be pretty strange for a kid to run accross. Has anyone heard, seen this happen before? Could there be some virus doing this? Any help appreciated.
Were these posts or comments? I’m sorry but I’m still not quite as good with Manila as I’d like to be… I would say that either there is a vulnerability in Manila that you are witnessing where someone is accessing an open script of some sort to edit posts, or you simply have a hacker who has a username and password for the blog and has edited the posts. Any way to see if a post/comment has been edited, and if so, when and by whom? Time to have everyone change password I’d imagine. Good luck and let me know what you find out.
On another note, I was poked around with the three links for a while. Thor and I put our heads together and think the sites are used to manipulate people’s google rankings. For instance the dubrovia.net pages seem to all look like real pages with real english, but upon further inspection (the type of further inspection google’s computers cannot do) they don’t make any sense. They do however have H1 and H2 tags and links in the text, along with links at the bottom, and a “copyright” with links there too… All the links seem to have normal run of the mill words along with “public” in the link. It would seem that someone is 1) trying to water down someone else’s google page ranking for the term “public” and 2) increasing their own page ranking for “public” – none of the links ever go anywhere of interest, it just and endlist list of pages with links to pages with links to pages with links to… I didn’t believe it when I saw it but I eventually found myself at http://movies.dubrovina.net/portland_public_schools.html
Hey Paul…thanks for the detective work. I thought this looked too similar to be kids work. But I didn’t have the time to drill into it. I don’t think it’s a hacker…probably spyware of some sort since the posts were made from home computers. What fun!