Hacker News Reader

Comment by batch12 | Hacker News Reader

These looked like cached search results. I am not seeing the IOCs on the live site unless I am missing it or they're only showing them to googlebots.

One can see the results by searching google for the domain and the "gold" string from the article.

View on HN

This is standard practice for hacked wordpress sites. They only serve the compromise to organic search traffic.

Yes, I have heard this called a link cloaking hack, methinks.

Thank you for bringing this up! The plot thickens: https://shottr.cc/s/1CXn/SCR-20240426-cm4.png

This is why it's fairly common for people to say "Google says my site is hacked, but when I check it's fine!" on webdev forums.

Clicking the link from the google search results continues to work, I just tested it on my phone. Visiting the page directly continues to redirect for me

If you think the site is still serving the redirects I’m going to make a phone call to a publicly available number of some Cyber Crime division for Georgia’s GBI.

From the screenshot linked above:

  curl -i -H 'Referer: google.com' https://team.georgia.gov/medicicnes/kamagra-gold-100/
  HTTP/1.1 301 Moved Permanently
  Date: Fri, 26 Apr 2024 12:36:14 GMT
  Server: Apache/2.4.6 (CentOS)
  X-Powered-By: PHP/7.4.33
  Location: https://gomylink.site/vkKXXr8G?sub1=kamagra-gold-100&sub2=team.georgia.gov
  Connection: close
  Transfer-Encoding: chunked
  Content-Type: text/html; charset=UTF-8

Good find- I was on my mobile at the time so couldn't dig this deep so I am happy to see someone figured it out.

Test it yourself: https://www.google.com/search?q=team.georgia.gov+%22kamagra%...

I tried the first 5 links and none of them showed the hacked content in the resulting page. At least for me the Google results were all old caches.

Note that browsers/extensions/settings that hide your referrer might prevent you from encountering this redirect

Could you try setting the referrer to google.com in the WGET? https://shottr.cc/s/1CXn/SCR-20240426-cm4.png

Worked for me with no changing of any referrer or other HTTP settings. Clicking on the first georgia.gov resulted redirected me to the spam site. (Win11 + Chrome)

Reply on news.ycombinator.com