Wed, 13 Jun 07 - I really don't know whether this is spam or not...

I’ve received another innocent looking comment, “Hey man, thanks for article!”, this time from gribitonline.com.

I followed the same procedure as last time and found that this site contains the same style porn links at the bottom of the page. The site looks more genuine than all the others, hence the title – I’m really not sure whether this is intentional spam or whether it’s been hijacked.

I did some investigation to see if I could find the provider of the porn links. Unfortunately I’ve not found anything obvious, although I have noticed some patterns.

• The porn links are embedded within the body of the page and then moved to the bottom with the help of javascript. I assume that this is an SEO trick, based on the understanding that links in content are granted higher ratings than links just for navigation.

Site without javascript enabled

Site with javascript enabled

• The javascript used to move the links always looks like this.

var el, el2;
el = document.getElementById('cbceddfd');
el2 = document.getElementById('cceedfda');
if (el && el2)
el2.appendChild(el);
el = document.getElementById('bfabedba');
el2 = // ... and repeat

• Each link is inserted into its own empty span at the bottom of the page. The spans seem to have the same ids on each of the sites that have these type of links. The first span is always cceedfda, the second is cecfaabe, with subsequent ids also being the same across different sites. There doesn’t appear to be any other pattern to the ids.

• Sites from previous experiment that follow this pattern
  • timesofsooz.com
  • pinkyspaperhause.com
  • moradblog.com
  • fromgreghead.com

• I’m really quite intrigued by these sites. Sad, I know.

---