1

Here's a URL that you may not want to open (should be fine with a modern browser though):

http://www.primavera.honda.com/ga01/fwsg8.php?teu=boat-puns-captions

It seems to redirect through a bunch of different spammy, malware-type sites.

What's going on there? That's Honda's domain, right? Is this part of a blackhat SEO network or something? I've tweeted Honda just in case.

Edit: Definitely looks like this is the work a (wordpress?) hacker. Here's a bunch more that I found via google:

http://www.truenorthpsychiatric.com/zoiruhe/uonirue.php?altr=RIP-boiling-water-You-shall-be-mist
http://www.seculardirectory.org/vyke/yjzi7.php?teu=disney-pun-team-names
http://studentvoicei.org/5vvy/r2bhj.php?teu=meme-account-name-ideas
http://www.angelcitycars.co.uk/zoiruhe/uonirue.php?altr=Was-Kid-Rock-ever-Cool
http://passatonce.co.uk/8dut/nyx0a.php?teu=words-pun-generator
http://www.trustligas.com.br/yg6k/il8ds.php?teu=water-pun

And this one has the <title> element changed to "Hacked by CyberPirate !":

http://falkontravel.com/ehxg/5xqgk.php?puc=paddle-puns

Seems like there are hundreds of sites like this (in google search results) that have been compromised.

Improve this question
1
  • 1
    It's not just you seeing this, looks like either their DNS or one of their sites has been compromised.
    – Alexander O'Mara
    Commented Feb 3, 2018 at 1:26

1 Answer 1

Reset to default
1

That's Honda's domain, right?

Yes it is. Either one of their web servers or their DNS has been compromised.

Is this part of a blackhat SEO network or something?

Most-definitely. A domain for a large company linking to other websites raises their page rank.

Of course, it's possible the compromised web server is also up to other nefarious things.

Improve this answer

You must log in to answer this question.