Analysis of a Hijacked Site (Part I)

This report describes the discovery of a hijacked website used to host large-scale SEO spam pages ("Hot Video" pages). The attacker deployed obfuscated PHP scripts and templates to auto-generate ~1.1M spam links across ~139 compromised domains, logged crawler access (predominantly Google), and used Flash and other redirects to send users to malicious fake-AV pages; the write-up enumerates files, directories, domains, and the scripts' behavior.