Hello Geoff, It perhaps could be a DDoS attack, which is a malicious attempt to make a server or a network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet. Have you had a read of this <http://www.incapsula.com/blog/googlebot-study-mr-hack.html <http://www.incapsula.com/blog/googlebot-study-mr-hack.html>>
Cheers, Ronni > On 22 Jan 2015, at 3:24 pm, Kaye and Geoff <[email protected]> wrote: > > Hello Muggers > > I have an interesting problem which someone might recognise and be able to > explain. It is a version of a web page hack, but with specific symptoms. It > involves an environmental organisation called Greenskills - we do their web > page support for them. > > They own several domains, in particular greenskills.org.au and > ecojobs.org.au. Ecojobs.org.au is being phased out so if you point a browser > at it a page is displayed which immediately redirects to an "ecojobs" page on > the main site. Or at least this is what happens if you enter the URL > www.ecojobs.org.au/. With this format you rely on the default HTML file name, > which in this case is index.html, as is standard for most sites. > > However if you enter www.ecojobs.org.au/index.html, you get a flashy page > which wants you to sign up for what I suspect is a pyramid selling scheme. > The html source is for this flashy page, it has not done a redirect and the > ecojobs URL is the one displayed in the window at the top of the browser. > > The nameservers for ecojobs.org.au have not been corrupted - they point to > the correct place. > > A search of the net has, surprisingly, shown no pertinent information about > this scam. The source code has some links in the header which suggest that > someone in the Ivory Coast might be behind it. The source code does not > appear to have any actual nasties in it; ie. any code or links which look > like they might be trying to download a virus or something along those lines. > > Has anyone got any insights into this? In particular at what point in the > process of retrieving the web page does the "switch" occur? > > I have informed the hosting company which Greenskills use but so far have no > comment from them. > > Thanks > > Geoff > ----------------------- > Kaye and Geoff > [email protected] >
-- The WA Macintosh User Group Mailing List -- Archives - <http://www.wamug.org.au/mailinglist/archives.shtml> Guidelines - <http://www.wamug.org.au/mailinglist/guidelines.shtml> Settings & Unsubscribe - <http://lists.wamug.org.au/listinfo/wamug.org.au-wamug>
