1

Here's a URL that you may not want to open (should be fine with a modern browser though):

http://www.primavera.honda.com/ga01/fwsg8.php?teu=boat-puns-captions

It seems to redirect through a bunch of different spammy, malware-type sites.

What's going on there? That's Honda's domain, right? Is this part of a blackhat SEO network or something? I've tweeted Honda just in case.


Edit: Definitely looks like this is the work a (wordpress?) hacker. Here's a bunch more that I found via google:

http://www.truenorthpsychiatric.com/zoiruhe/uonirue.php?altr=RIP-boiling-water-You-shall-be-mist
http://www.seculardirectory.org/vyke/yjzi7.php?teu=disney-pun-team-names
http://studentvoicei.org/5vvy/r2bhj.php?teu=meme-account-name-ideas
http://www.angelcitycars.co.uk/zoiruhe/uonirue.php?altr=Was-Kid-Rock-ever-Cool
http://passatonce.co.uk/8dut/nyx0a.php?teu=words-pun-generator
http://www.trustligas.com.br/yg6k/il8ds.php?teu=water-pun

And this one has the <title> element changed to "Hacked by CyberPirate !":

http://falkontravel.com/ehxg/5xqgk.php?puc=paddle-puns

Seems like there are hundreds of sites like this (in google search results) that have been compromised.

  • 1
    It's not just you seeing this, looks like either their DNS or one of their sites has been compromised. – Alexander O'Mara Feb 3 '18 at 1:26
1

That's Honda's domain, right?

Yes it is. Either one of their web servers or their DNS has been compromised.

Is this part of a blackhat SEO network or something?

Most-definitely. A domain for a large company linking to other websites raises their page rank.

Of course, it's possible the compromised web server is also up to other nefarious things.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy