Wed, 13 Jun 07

I really don't know whether this is spam or not...

I’ve received another innocent looking comment, “Hey man, thanks for article!”, this time from gribitonline.com.

I followed the same procedure as last time and found that this site contains the same style porn links at the bottom of the page. The site looks more genuine than all the others, hence the title – I’m really not sure whether this is intentional spam or whether it’s been hijacked.

I did some investigation to see if I could find the provider of the porn links. Unfortunately I’ve not found anything obvious, although I have noticed some patterns.

Site without javascript enabled

Site with javascript enabled

var el, el2;
el = document.getElementById('cbceddfd');
el2 = document.getElementById('cceedfda');
if (el && el2)
el2.appendChild(el);
el = document.getElementById('bfabedba');
el2 = // ... and repeat