Windows Defrag to News 9 Today Browser Scam

Free Windows Defragmenter Search

Take this for a scam and a half way of fixing the Google search results!

Defrag Search Results

Defrag Search Results

Today I was looking for an old defrag program, but couldn’t remember the name – so I went to Google.  That’s the screenshot on the right.

The second result looked promising.  After all, the text says,

Anyone know what is currently the best defragmenter for Windows 7 x64 64 bit, and why? Does it have any problems?

News 9 Today  (news9today.org)

News9 Today

News9 Today

Unfortunately, tehparadox.com is not all it seems.  The page actually referenced is http://tehparadox.com/forum/f85/best-defragmenter-windows-7-x64-452359/, which looks kosher enough, but it has nothing at all to do with disc defragmenters, and everything to do with get rich quick schemes!! (That is a screenshot on the left).

It’s like all the other fake news sites that we’ve seen recently, except in this case, the whole meta data of the website is built to deceive the search engines!

For instance, the title stays in the browser tabs, saying,

“Best defragmenter for Windows 7 x64 64 bit?”

The whole html source code is here.  You’ll see that the meta data bit reads:

name=”keywords” content=”Best,defragmenter,Windows,7,x64,64,bit, Best defragmenter for Windows 7 x64 64 bit?, downloads,free,resources,online,sharing,community,movies,games,720p,1080p,anime,applications,music,tv shows,e-books,comic books,discussions,warez,dvdr,rapidshare,megaupload,netload,hotfile,fileserve,filesonic”

name=”description” content=”Anyone know what is currently the best defragmenter for Windows 7 x64 64 bit, and why? Does it have any problems? Or should I just use the default one that comes with Windows 7? Thanks.”

Where Does it Point?

The links all go to

https://ssl.clickbank.net/order/restricted.html?errCode=accntstate&cbhopvendor=homejonlin

which then redirects to

http://www.home-online-jobs.org/check-positions-available/?hop=maspromo

WHOIS www.home-online-jobs.org

Well, they’re hidden of course.  You should know what I think of businesses that choose to be anonymous, but to repeat, I think they’re shite.  See ‘http://whois.domaintools.com/home-online-jobs.org for their “details”.

Noticeably, they have very peculiar name servers:

Name Server:NS1.MYHOMEWEALTHSYSTEM.COM

Name Server:NS2.MYHOMEWEALTHSYSTEM.COM

MYHOMEWEALTHSYSTEM.COM

This bunch of jokers are also hidden, see ‘http://whois.domaintools.com/myhomewealthsystem.com but they Do have an actual web page promoting much the same stuff.  This has been seriously debunked by Paul at WorkAtHomeTruth here back in March 2010.  He has more red flags than the semaphore kid going on it.

The Biggest Killer Laugh of All

News9TodaySmallPrint

News9 Today Small Print

MyHomeWealthSystem at least has a web page.

Now go back to the top and examine News9Today.  Down at the bottom of their small print, they say:

Copyright 2010 © News9Today.org All Rights Reserved.

Hmm?  A website URL.  I wonder what it looks like?

Well actually, if you can recall the CNN logos at the top of the page, like so (directly from their server):

Tehparadox

As seen on CNN? Ha Ha!

After getting the link to the header image above which is sourced from http://www.news9today.org/home-job-news/index_files/features16.jpg, I back-spaced to go back to the News9 Today page – and ended up on the tehparadox page here:  http://tehparadox.com/forum/f85/best-defragmenter-windows-7-x64-452359/

You see in the screenshot that the top advert is a “Google Is Hiring” scam advert?  Where does it go?

A. Well http://www.news9today.org/home-online-job-positions/?tid=hojab6 of course!

Conclusion

Somehow the browser has been redirected from the Google search page to the header advert from the tehparadox website.  This could be SQL injection or a bug in their server or my browser setup.

Whatever, this really stinks, and it’s a new thing to be wary about.

Related Posts:

5 responses .

  1. Not Kevin says:

    Interesting, looks like these are all on the same server:

    Automatedhomeprofits.com

    Elitewealthpackage.com

    Home-online-jobs.org

    news9online.org

    momsincomesystem.com

    news9today.org

    quickcashkit.net

    PaidSurveysGroup.com

    Automatedhomeprofits.com is registered to:

    Dotcom Internet Marketing

    Telephone: 480 304 5449

    Station House

    North Street

    Havant, PO9 1QU
    http://whois.domaintools.com/automatedhomeprofits

    PaidSurveysGroup.com has the same address in their terms and conditions:

    Paid Surveys Group

    Dot Com Internet Marketing Limited.

    Registered Office: Station House, North Street, Havant, PO9 1QU

    Email: csupport(@)paidsurveysgroup.com

    Phone: 480-304-5449

    Companies House shows a:

    DOTCOM INTERNET MARKETING LIMITED

    STATION HOUSE

    NORTH STREET

    HAVANT

    HAMPSHIRE

    UNITED KINGDOM

    PO9 1QU

    Company No. 06928823

    Date of Incorporation: 09/06/2009

    • Strangely says:

      Funny thing, @Not Kevin…. have you ever tried to do a Google search on any of these domains (and similar)?

      Almost without exception, they NEVER come up in the search results as a domain but nearly always linked to some consumer complaint type thing!

      You'd think that most websites would want to publicise their existence, wouldn't you? Not so with the fake news & blog sites and other web slime. The seek to live in the shadows. All the News9 ones even redirect to CNN!

      Another recent addition to the marketing techniques that I've just noticed is the "secret link" down at the bottom next to the T&Cs. This is similar to0 the "please don't go" popup in that they are "pleased" that you've spotted the link and are obviously an astute person as you must be checking the T&Cs, so as a bonus, you can buy "insert rubbish product name here" at the reduced price of "insert made up amount here" for being so clever!

      It's another trap to butter up the sucker by pandering to his or her ego.

  2. Kevin says:

    How do these types of sites even get past Google's supposed strict QC in Adwords? Clearly it's a scam since it leads people to believe it's what they are looking for and end up on something totally different from what they searched for. Isn't that a breach of Google's TOS? Or is it because the are paying top dollar hence Google is happy without a care?

    n.b. back-link removed as the Philippine IP address country does not match the Swedish site URL! (SP)

  3. DB says:

    Anyone figure out how to get your search engine back from these jokers.  i am hijacked with this exact series of websites.

    • Strangely says:

      Hi DB.  I’m not sure what you mean by that.  But I think you mean that your Google or Bing (say) homepage no longer starts when you open your browser.

      If that’s the case, you would best start off looking at this Wikipedia article:

      http://en.wikipedia.org/wiki/Browser_hijacker

      I’m loath to set you off doing a search for “browser homepage hijack” because many first and second page result returns are actually from malware sites which would compound the problem if you followed their suggestions!

      Your problem could be easily reset from the browser options, or it could be much more serious and due to a trojan or other malware infection on your machine.  Without knowing more, it’s hard to tell.

Leave a Reply

Your email address will not be published. Required fields are marked *

© 2007-2017 Strangely Perfect All Rights Reserved -- Copyright notice by me