Google Redirection

[Jen's Baby]

I've been having this issue for a while but kinda thought it might be something bad on my own computer.

But recently I had a HDD failure so had to start again from the ground up. I'm using a windows 7 image taken directly from MS's download server (digital river) so I know there is no mal ware on my machine.

OK. so I google Daily Diapers and google returns the site as its no 1 result. if you click the "forum" link from the google result it quickly takes me to DD but then redirects me to a hxxp://tinyurl4.X based URL (masked the url so it can't clicked.If your a user please don't go looking for it as its outside the control of DD and may contain malware) It only seems to happen if I click the forum sub link from google and only happens if I clear my cookies (maybe a way to make it not as noticable (using the refere header to see the link as come from google and set) but thought you should know as there might be a bit of rouge code floating around.

Did a bit of googling and DD is not the only site to having this issue, seems a bit of rouge code got in and not been nulled in a update.

Just thought you admins should know.

[Diapered Jason]

Hey, I recognize that URL. I think I have had this happen to me as well. I do this very rarely, but once in a while I click on one of the sub-links under DailyDiapers.com when you do a google search and what you describe happens. I was only there for a sec before I quickly exited out. Luckfully, no harm done.

[AutieAB]

I can reproduce this, I'm afraid

When you browse to the forum from a Google search result with no cookies set for dailydiapers.com, the server returns some obfuscated Javascript that once evaluated redirects the viewer to the site mentioned by the OP.

To repro:

• Clear all dailydiapers.com cookies

• Disable Javascript in the browser

• Search Google for something that returns a link to the DD forum. site:dailydiapers.com "bambino diapers brand" works.

• Click the search result (you'll get a blank page)

• View the source.

• De-obfuscate the JS it contains to see what's going on...

Something, somewhere is injecting some rogue JS into the page that users see when they visit from Google when there are no forum cookies set.

Windows 7 / Firefox 5.0

[edit to add]

http://www.dailydiapers.com/board/index.php?showtopic=24529

[DailyDi]

Think we found it. Please check now

[Jen's Baby]

I'm no longer getting the redirection on any of my devices.

Think you nailed it.

[DailyDi]

Thanks for checking. Was a 3rd party add-on stealing traffic from us... bastards!

[bbgirlmichelle]

What was the name of the addon so others can avoid it? I maintain multiple copies of IPB.

[DailyDi]

DonationTracker was the corrupted add-on.

[AutieAB]

Yep, definitely gone

Was a 3rd party add-on stealing traffic from us... bastards!

Makes sense, the obscured code had some stuff in it that checked for some IPB specific cookies... Bastards indeed - sneaky as heck too, checking for no cookies so at a casual glance by an existing user it would look like nothing was wrong...

[Jen's Baby]

And admins are going to have cookies set so nothing is going to look out of place during install and testing ;-)

I still live in hope that one day the internet will grow up and stop silly things like this. Its never gonna happen, as one rouge dev grows up and starts behaving there are 2 ready to take their place but I can still live in hope :-p

[peepeepants]

googling site:dailydiapers.com "bambino diapers brand" still sends you to dollartrade

[AutieAB]

Affirmative, it's back

[DailyDi]

Site update coming tonight, hopefully it will replace the corrupted file