About 6 months ago a friend mentioned that whenever she tried to visit my site it tried to download something. After typing in my url: http://bobbydoran.net I discovered nothing amiss and just assumed she was smoking crack. During this period I have been very busy so my design site was a very low priority. I did notice that my inquires had dropped off to nothing but dismissed it as my fault for not putting in the time that I had used to promoting my site. Again, with training with the Army and doing design for a company rather than myself I wasn't overly concerned.
The other day I decided to install Google Analytics on my site to see what it would show me. I couldn't access my FTP. Thinking I messed up the password I requested a new one be sent as it had been forever since I logged on and wasn't quite sure what it was any longer. After NOT getting the email I realized my account was using a now defunct email. A quick email to my hosting company and a verification later I was back in business.
As I was looking through the folders on the server I noticed some strange files that I knew shouldn't be there because I didn't put them there. They were named ht_access and ht_access_mal. Every folder on my server had these files in them. Even the sub-folders in my folders. Now I don't know how to code except XHTML and CSS but I've played with enough javascript and actionscrtipt to where I can usually look at the code and can tell what it is going to do. It seemed to me this code was a redirect of some sort. But a very tricky sort.
This is where it gets interesting. It seems this code would only redirect a user from my site to one of those scam download this spyware your computer is infected sites if the user clicked my link on a search engine. If the URL was typed in the browser or someone had my site bookmarked it would go to the site like it was supposed to. Finding my site on a search engine I tested my theory and sure enough, I was brought to an attack site that closed all my tabs but one and tried to get me to download some anti spyware virus crap. In a fit of rage I deleted all the files from the server. Clearing my cache and history I tried it again. This time it went to my site, so for now the problem is fixed. I will be contacting my hosting company and informing them of the intrusion of my domain.
This is the first time that I have heard of hackers attacking a site in this fashion. Has anyone out there heard of this subtle technique? Because I hadn't updated in quite some time nor spent any time with SEO this went on for quite some time. How much business has this cost me? How many lost clients did I miss out on? How tarnished is the name of my site by people clicking on those hijacked links? I'd love to skin whoever did that to me alive, pour lemon juice on the raw flesh and leave them on a fire ant hill to die a slow death.