I really don't know whether this is spam or not...
I’ve received another innocent looking comment, “Hey man, thanks for article!”, this time from gribitonline.com.
I followed the same procedure as last time and found that this site contains the same style porn links at the bottom of the page. The site looks more genuine than all the others, hence the title – I’m really not sure whether this is intentional spam or whether it’s been hijacked.
I did some investigation to see if I could find the provider of the porn links. Unfortunately I’ve not found anything obvious, although I have noticed some patterns.
var el, el2; el = document.getElementById('cbceddfd'); el2 = document.getElementById('cceedfda'); if (el && el2) el2.appendChild(el); el = document.getElementById('bfabedba'); el2 = // ... and repeat
- Each link is inserted into its own empty span at the bottom of the page. The spans seem to have the same ids on each of the sites that have these type of links. The first span is always cceedfda, the second is cecfaabe, with subsequent ids also being the same across different sites. There doesn’t appear to be any other pattern to the ids.
- Sites from previous experiment that follow this pattern
- I’m really quite intrigued by these sites. Sad, I know.