SEO Cloaking Malware Feeds Gambling Spam to Search Engine Crawlers
Summary
A PHP implant fetched gambling spam from fugthatshit[.]baby and served it to search engine crawlers while showing normal content to visitors. The article details its behavior, indicators, and remediation steps.
Key points
- Malicious PHP code was appended to a legitimate application file, pages/index/IndexHandler.php.
- The script checked user-agent strings for crawlers such as Googlebot, Bingbot, and Baiduspider.
- For identified crawlers, it fetched spam content from fugthatshit[.]baby, displayed it, and exited before the application ran.
- Regular human visitors were served the site normally, concealing the SEO spam from routine checks.
- Reported indicators include fugthatshit[.]baby, /desktop/kindipublisher.txt, and IP address 104.21.50.131.
- The article says the domain and IP were blocklisted and SiteCheck detects the issue as spam.
- Recommended response includes removing malicious files and suspicious accounts, resetting credentials, updating software, monitoring outbound traffic, and using a WAF.
Article Details
- Attack Vectors
- Malicious PHP code was appended to pages/index/IndexHandler.php in a compromised website.
- The code checked visitor User-Agent strings and served spam content only to search engine crawlers, while ordinary visitors saw the legitimate site.
- The malware used cURL to retrieve spam content from an attacker-controlled remote domain, then replaced the page output and terminated application execution for crawlers.
- Defensive Notes
- Remove unrecognized malicious files or directories and audit administrator accounts for suspicious users.
- Reset administrator, FTP, hosting, and database credentials.
- Run a full antivirus and malware scan on administrator devices, and keep software up to date.
- Monitor server logs and outgoing traffic for connections to unknown or suspicious domains.
- Use a Web Application Firewall to help block communication with known C2 servers and prevent malicious plugin uploads.
- Perform proactive file monitoring, integrity checks, and regular security monitoring.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fugthatshit[.]baby | Attacker-controlled domain used to serve spam content to the compromised website. |
| IPV4 | 104[.]21[.]50[.]131 | IP address reported as associated with the malicious domain and blocklisted by the researchers. |
| URL | hxxps[:]//fugthatshit[.]baby/desktop/kindipublisher.txt | Payload URL hosting spam content retrieved by the malware. |