this site has been hacked

[twobjshelbys]

Originally Posted by mrmustang

Yet, strange, as it does not happen on any of the sister sites, at all, which as mentioned earlier (either here or in email to Brent), only differs by version of the software (3.8.0 here and Club Chopper, vs 4.1.3 on CHR)

Bill S.

Do you share advertisers?

I'll assert, for the umpteenth time, that the source of the corruption is not resident on this site but on one of the sites linked from this site, most like an off site advertisement content. It is unusual for ads to have their HTML resident here, instead being accessed by a link to that content. Look there first. Taking away all ads and adding them back a few at a time might help zero in on which one(s) are the culprit.

Once again, simply clicking on ads from a Windows PC won't do any good. You have to examine their sources and look for specific behaviour based on a comparison of the browser type (it is sent when a link is opened). They are looking for specific mobile platforms.

Note: I cite the ads because they are not constant - vendor ads seem to rotate, so to get redirected you have to (1) be on a mobile platform when viewing and (2) hit the variable content in the right cycle. It's always possible that there is some other algorithm like a time clock or something else. I looked at cookies and didn't see anything obvious would be used to only do it every n'th time or something like that.

Of course if you remove all offsite links, and the problem still happens, then the hack is in local content. But the first step would be to scrub all the local HTML for paths that are specific to a mobile browser. Also don't preclude any "server" things like .asp's from being the source, and if those are binaries with dates that look wrong replace them.

Wasn't this site moved to a new server during the last crunch? Could this problem have been planted then?