Lotus what? Nah mate, the world has moved on.

Tuesday, 25 February 2014

Sorry! helperblogger redirecting to mypageresults - Fixed. ~ Ray said what???

Sorry! helperblogger redirecting to mypageresults - Fixed. ~ Ray said what???:



'via Blog this



Interesting semi-hacking stuff:



















I added some code from helperblogger to my Blogs last year to show recent posts. When I looked at my blog today it redirected me to -->

http://mypageresults.com/?dn=code.helperblogger.com&fp=QBQ8CivDdJqA6EYjct%2B%2BxBezE8hTO9KWfLMHwZb6C9g%2FQzObao0CWx3Ex73UyJK9TdiQm04m6WdkYjP7QHEwqw%3D%3D&prvtof=y6Fx7YPPzisjVlJYz4Eb%2BElqwiPNpsYfJThAyXK%2B5%2FBT8wib7c7RLd69mPVMkW5Dn%2F5%2BsJzdxISMDEBzqkEf28znzwwEnjVRcloCZgg%2F37qp3cBqW%2F%2BW2qH3qhg%2BfpyI&poru=9TqkgviPRu1jgnnIAZCC3Qt1zOi0TnZ1NzCy4KCMDxNX4lfmzL39HKiBzEvV%2B2zRK0r7E6819ctgl04ZhgBujPNDa0wnA1oVBqHmcZjNZYw3YSPjJiH7wO0JqHpmqPL7&cifr=1&flrdr=yes&nxte=js

WHAT THE HELL!!

I only run Linux and virus's is not what I expect.

I started by checking Chromium and found nothing but my blog(s) still redirected me. The other pages were ok so it must have been something on my blogs. Weirdly Firefox did not do this.

I then added a host entry to redirect mypageresults.com to 127.0.0.1 to stop the redirection and investigate.

I took a quick look at the Chrome : //About settings and found nothing bad.

I then checked chrome://view-http-cache/ to see when this started.

I found some strange stuff in the cache -->
https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash2/t5/s40x40/1116296_100002482006063_1069675774_q.jpg

Hope I do not know this apparent wanker. Mind you, it is a facebook cache so could be anyone including me ;-)

I searched the source on on of the pages and found some code from helperblogger. When I checked helperblogger the site was no more. Oh Oh!















I then removed all the code below from all my blogs and continued my searching.

It seems that a request for:

http://www.helperblogger.com/recent-posts-spy.js

returns:

http://pagesinxt.com/?dn=www.helperblogger.com&flrdr=yes&nxte=js

Pagesinxt.com?

and then returns:

http://mypageresults.com/?dn=www.helperblogger.com&flrdr=yes&nxte=js

Bastards! Here is my wish for the owner of helperblogger and mypageresults. I hope and wish your fingers turn to fish hooks and your ass start itching, badly.


From what I can tell pageinxt is owned by mypageresults. These are some of the websites on this Ip Address.

33 are live websites using this IP (208.91.196.4) NOW -
  searchremagnified.com (#200,555)     searchreinvented.com (#119,367)     searchdiscovered.com (#256,382)    searchignited.com (#3,099,745)     searchmagnitude.com (#1,535,686)     kolmic.com (#425,329)     ztomy.com(#935,313)     pagequeryresults.com (#3,538,536)     searchinvented.com (#1,783,213)     webqueryresults.com(#1,966,302)  
... ... ... Found: 33 websites on this ip ... ... more »
        see also: All websites in this IP Range »

3 live websites used this IP (208.91.196.4) Before -
  • danteen.net (#2,526,992)         used IP on 13 September 2013
  • instantfwd.com (#30,188)         used IP on 18 March 2013
  • kissmyass.com (#2,056,659)         used IP on 25 October 2012
... and 16 Live websites using this ns - ns1004.ztomy.com :
  instantfwd.com (#93,858)     pagequeryresults.com (#3,538,536)     webqueryresults.com (#1,966,302)    sitequeryresults.com (#3,405,390)     keywordqueryresults.com (#1,495,503)     cinema.in (#2,070,661)    searchqueryresults.com (#3,573,302)     searchtermresults.com (#120,250)     quickfwd.com (#3,551,860)    searchmeaningful.com (#74,696)  



I found some answers on google now as well.

https://productforums.google.com/forum/#!topic/blogger/31LWhN0Llmc



Here is the offending code that has been removed. Sorry! Think Tony Haywood!




<h2 class='title'>Recent</h2>

<style media='screen' type='text/css'> <!-- /* ========== Scrolling Recent Posts Widget By helperblogger.com ======== */ #helperblogger-widget { overflow: hidden; margin-top: 5px; padding: 0px 0px; height: 385px; } #helperblogger-widget ul { width: 295px; overflow: hidden; list-style-type: none; padding: 0px 0px; margin: 0px 0px; } #helperblogger-widget li { width: 282px; padding: 5px 5px; margin: 0px 0px 5px 0px; list-style-type: none; float: none; height: 80px; overflow: hidden; background: #fff url(https://lh6.googleusercontent.com/-A6a829gqfDQ/T-3xppy6MlI/AAAAAAAACFE/RrOao4P11Uk/s1600/helperblogger.com-post.jpg) repeat-x; border: 1px solid #ddd; } #helperblogger-widget li a { text-decoration: none; color: #4B545B; font-size: 15px; height: 18px; overflow: hidden; margin: 0px 0px; padding: 0px 0px 2px 0px; } #helperblogger-widget img { float: left; margin-top: 10px; margin-right: 15px; background: #EFEFEF; border: 0; } #helperblogger-widget img { -webkit-transition: all 0.5s ease; -moz-transition: all 0.5s ease; transition: all 0.5s ease; padding: 4px; background: #eee; background: -webkit-gradient(linear, left top, left bottom, from(#eee), color-stop(0.5, #ddd), color-stop(0.5, #c0c0c0), to(#aaa)); background: -moz-linear-gradient(top, #eee, #ddd 50%, #c0c0c0 50%, #aaa); -webkit-border-radius: 4px; -moz-border-radius: 4px; border-radius: 4px; -webkit-box-shadow: 0 0 3px rgba(0,0,0,.7); -moz-box-shadow: 0 0 3px rgba(0,0,0,.7); box-shadow: 0 0 3px rgba(0,0,0,.7); } #helperblogger-widget img:hover { -moz-transform: scale(1.2) rotate(-350deg); -webkit-transform: scale(1.2) rotate(-350deg); -o-transform: scale(1.2) rotate(-350deg); -ms-transform: scale(1.2) rotate(-350deg); transform: scale(1.2) rotate(-350deg); -webkit-box-shadow: 0 0 20px rgba(255,0,0,.4), inset 0 0 20px rgba(255,255,255,1); -moz-box-shadow: 0 0 20px rgba(255,0,0,.4), inset 0 0 20px rgba(255,255,255,1); box-shadow: 0 0 20px rgba(255,0,0,.4), inset 0 0 20px rgba(255,255,255,1); } .spydate { overflow: hidden; font-size: 10px; color: #0284C2; padding: 2px 0px; margin: 1px 0px 0px 0px; height: 15px; font-family: Tahoma,Arial,verdana, sans-serif; } .spycomment { overflow: hidden; font-family: Tahoma,Arial,verdana, sans-serif; font-size: 10px; color: #262B2F; padding: 0px 0px; margin: 0px 0px; } /* ========== Scrolling Recent Posts Widget By helperblogger.com ======== */ --> </style>
<script language='JavaScript'> imgr = new Array(); imgr[0] = "https://lh6.googleusercontent.com/-kPPx1sCN4Pg/T-3xq72pLeI/AAAAAAAACFM/IdO7GsyUvGM/s1600/no-thumbnail.png"; imgr[1] = "https://lh6.googleusercontent.com/-kPPx1sCN4Pg/T-3xq72pLeI/AAAAAAAACFM/IdO7GsyUvGM/s1600/no-thumbnail.png"; imgr[2] = "https://lh6.googleusercontent.com/-kPPx1sCN4Pg/T-3xq72pLeI/AAAAAAAACFM/IdO7GsyUvGM/s1600/no-thumbnail.png"; imgr[3] = "https://lh6.googleusercontent.com/-kPPx1sCN4Pg/T-3xq72pLeI/AAAAAAAACFM/IdO7GsyUvGM/s1600/no-thumbnail.png"; imgr[4] = "https://lh6.googleusercontent.com/-kPPx1sCN4Pg/T-3xq72pLeI/AAAAAAAACFM/IdO7GsyUvGM/s1600/no-thumbnail.png"; showRandomImg = true; boxwidth = 255; cellspacing = 6; borderColor = "#232c35"; bgTD = "#000000"; thumbwidth = 50; thumbheight = 50; fntsize = 15; acolor = "#666"; aBold = true; icon = " "; text = "comments"; showPostDate = true; summaryPost = 40; summaryFontsize = 10; summaryColor = "#666"; icon2 = " "; numposts = 10; home_page = "http://secpen.blogspot.com/"; limitspy=4; intervalspy=4000; </script>
<div id='helperblogger-widget'>
<script src='http://code.helperblogger.com/recent-posts-spy.js' type='text/javascript'></script>
</div>
</div>



The code from mypageresults.

view-source:http://mypageresults.com/?dn=code.helperblogger.com&flrdr=yes&nxte=js


<!--
top.location="http://mypageresults.com/?dn=code.helperblogger.com&fp=uJesUZ8nFBmEbKtu6e0EpipkoIYA%2BTMbBtIDVbcYUXNjBeABUHTc39Hc3aE%2F2vB5v77mAa%2FN0%2FA2zKDJG4HH2g%3D%3D&prvtof=tziIyUlJ4AJ7r%2FPvW2QcaYNq2KNxX3Zs8olmWyo5B9k%3D&poru=%2BGUrtqySCVry4UbYXNgt7HuDl5I7RC7Iy89jtvUc9NHhF3bcnNbRdbnS7Ihd2n0VEMtHc0k2HQx91N5Fp5fPGKm0ZieMTipdGSXkUqY8yc2%2BcoKfGbS5uja0OCmj8b%2Fi&cifr=1&flrdr=yes&nxte=js";
/*
-->
<script type="text/javascript">
<!--
dimensionUpdated = 0;
function applyFrameKiller()
{
if(window.top != self)
{
cHeight = 0;
if( typeof( window.innerHeight ) != 'undefined' ) {
//Non-IE
cHeight = window.innerHeight;
dimensionUpdated = 1;
} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {
//IE 6+ in 'standards compliant mode'
cHeight = document.documentElement.clientHeight;
dimensionUpdated = 1;
} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {
//IE 4 compatible
cHeight = document.body.clientHeight;
dimensionUpdated = 1;
}
if( cHeight <= 250 && dimensionUpdated == 1)
{
window.top.location = "http://mypageresults.com/?dn=code.helperblogger.com&fp=uJesUZ8nFBmEbKtu6e0EpipkoIYA%2BTMbBtIDVbcYUXNjBeABUHTc39Hc3aE%2F2vB5v77mAa%2FN0%2FA2zKDJG4HH2g%3D%3D&prvtof=u%2BuM2EHbEQAlr%2Bkl%2BmcuosEAQIavqx%2BFUYdBKunMrqs%3D&poru=1hmPIWFWmJcMT7UK0wYV4kDp8fudtdytIdn9tBonxcKLoQyS%2BXeWhV2dbbLD2QOh9Nm%2FkNYu3s2oJSgGwdzpYjue9ryXs71Np43w60dzx0bjpQJNMxw8MO37wZdcJobC&cifr=1&flrdr=yes&nxte=js";
}
}
}
applyFrameKiller();
// -->
</script><frameset rows="100%,*frameborder="noborder="0framespacing="0">
<frame src="http://mypageresults.com/?dn=code.helperblogger.com&fp=uJesUZ8nFBmEbKtu6e0EpipkoIYA%2BTMbBtIDVbcYUXNjBeABUHTc39Hc3aE%2F2vB5v77mAa%2FN0%2FA2zKDJG4HH2g%3D%3D&prvtof=GJ6QLVsdcLmBzagIje4n5GlFtjFXcGaRUcHdekJ7Lf8%3D&poru=QZbyntkGEgHENe%2FEED%2Fa6tafzrOOoUTmGGoonVfpRIOTNkBSicaDQ0Chu9m2hJjYMOQ2ziwW%2B1xSjKFx7iE71Q4fWDDDYuxMjRMfZiZBj1LiZmiP6X7GyBVlYEasmbSc&flrdr=yes&nxte=js">
</frameset>
<noframes>
<body bgcolor="#ffffff" text="#000000">
<a href="http://mypageresults.com/?dn=code.helperblogger.com&fp=uJesUZ8nFBmEbKtu6e0EpipkoIYA%2BTMbBtIDVbcYUXNjBeABUHTc39Hc3aE%2F2vB5v77mAa%2FN0%2FA2zKDJG4HH2g%3D%3D&prvtof=dvlFDSPyyjPiHzVxTj8TfmKaeKjhGMO8QcG9K8Jn6aE%3D&poru=DumeodEAEaOj8jPpcWRBaQjyJJV7Sy2pHmDku6MGwn3pJrZm7ocOSiVuU9w39jlkYoxKvNy4S%2BU81X5fu0wPGPuHlDSuckv81QCfwh2bYU15V%2F7%2BpDsG71d2uJi29u7M&flrdr=yes&nxte=js">Click here to proceed</a>.
</body>
</noframes><!--
*/
-->
- See more at: http://raysaywhat.blogspot.co.uk/2014/02/sorry-helperblogger-redirecting-to.html#sthash.MuSA6R0t.dpuf

0 comments :

Post a Comment

Thank you for taking the time to comment. Your opinion is important and of value and we appreciate the positive feedback! If you are "Negative Nancy" then please do us, and humanity, a favor, and piss off.

Total Pageviews

Google+ Followers

Pages

Blog Archive

Popular Posts

Recent Comments

Rays Twitter feed

Ads

Web sites come and go and information is lost and therefore some pages are archived. @rayd123 . Powered by Blogger.