Windows Defrag to News 9 Today Browser Scam

Free Windows Defragmenter Search

Take this for a scam and a half way of fixing the Google search results!

Today I was looking for an old defrag program, but couldn’t remember the name – so I went to Google. That’s the screenshot on the right.

The second result looked promising. After all, the text says,

Anyone know what is currently the best defragmenter for Windows 7 x64 64 bit, and why? Does it have any problems?

News 9 Today (news9today.org)

Unfortunately, tehparadox.com is not all it seems. The page actually referenced is http://tehparadox.com/forum/f85/best-defragmenter-windows-7-x64-452359/, which looks kosher enough, but it has nothing at all to do with disc defragmenters, and everything to do with get rich quick schemes!! (That is a screenshot on the left).

It’s like all the other fake news sites that we’ve seen recently, except in this case, the whole meta data of the website is built to deceive the search engines!

For instance, the title stays in the browser tabs, saying,

“Best defragmenter for Windows 7 x64 64 bit?”

The whole html source code is here. You’ll see that the meta data bit reads:

name=”keywords” content=”Best,defragmenter,Windows,7,x64,64,bit, Best defragmenter for Windows 7 x64 64 bit?, downloads,free,resources,online,sharing,community,movies,games,720p,1080p,anime,applications,music,tv shows,e-books,comic books,discussions,warez,dvdr,rapidshare,megaupload,netload,hotfile,fileserve,filesonic”

name=”description” content=”Anyone know what is currently the best defragmenter for Windows 7 x64 64 bit, and why? Does it have any problems? Or should I just use the default one that comes with Windows 7? Thanks.”

Where Does it Point?

The links all go to

https://ssl.clickbank.net/order/restricted.html?errCode=accntstate&cbhopvendor=homejonlin

which then redirects to

https://www.home-online-jobs.org/check-positions-available/?hop=maspromo

WHOIS www.home-online-jobs.org

Well, they’re hidden of course. You should know what I think of businesses that choose to be anonymous, but to repeat, I think they’re shite. See ‘http://whois.domaintools.com/home-online-jobs.org for their “details”.

Noticeably, they have very peculiar name servers:

Name Server:NS1.MYHOMEWEALTHSYSTEM.COM

Name Server:NS2.MYHOMEWEALTHSYSTEM.COM

MYHOMEWEALTHSYSTEM.COM

This bunch of jokers are also hidden, see ‘http://whois.domaintools.com/myhomewealthsystem.com but they Do have an actual web page promoting much the same stuff. This has been seriously debunked by Paul at WorkAtHomeTruth here back in March 2010. He has more red flags than the semaphore kid going on it.

The Biggest Killer Laugh of All

News9TodaySmallPrint — News9 Today Small Print

MyHomeWealthSystem at least has a web page.

Now go back to the top and examine News9Today. Down at the bottom of their small print, they say:

Copyright 2010 © News9Today.org All Rights Reserved.

Hmm? A website URL. I wonder what it looks like?

Well actually, if you can recall the CNN logos at the top of the page, like so (directly from their server):

After getting the link to the header image above which is sourced from https://www.news9today.org/home-job-news/index_files/features16.jpg, I back-spaced to go back to the News9 Today page – and ended up on the tehparadox page here: http://tehparadox.com/forum/f85/best-defragmenter-windows-7-x64-452359/

You see in the screenshot that the top advert is a “Google Is Hiring” scam advert? Where does it go?

A. Well https://www.news9today.org/home-online-job-positions/?tid=hojab6 of course!

Conclusion

Somehow the browser has been redirected from the Google search page to the header advert from the tehparadox website. This could be SQL injection or a bug in their server or my browser setup.

Whatever, this really stinks, and it’s a new thing to be wary about.

Posted

January 2, 2011

Internet

Strangely

Tags:

CNN, Copyright, data, Download, engine, EVERYTHING, fake news, fault, GOOGLE, google search, HA, Ha Ha, HTML, HTTP, Joke, Killer, music, name, NET, NEWS, news sites, NOTHING, ORDER, program, Rapidshare, RE, REDIRECTS, Resource, RESULT, rights, Rights Reserved, scam, screenshot, Source Code, SQL, SSL, TITLE, truth, URL, war, whois, Windows

Comments

5 responses to “Windows Defrag to News 9 Today Browser Scam”

DB

January 3, 2012

Anyone figure out how to get your search engine back from these jokers. i am hijacked with this exact series of websites.

Log in to Reply
1. Strangely
  
  January 17, 2012
  
  Hi DB. I’m not sure what you mean by that. But I think you mean that your Google or Bing (say) homepage no longer starts when you open your browser.
  
  If that’s the case, you would best start off looking at this Wikipedia article:
  
  http://en.wikipedia.org/wiki/Browser_hijacker
  
  I’m loath to set you off doing a search for “browser homepage hijack” because many first and second page result returns are actually from malware sites which would compound the problem if you followed their suggestions!
  
  Your problem could be easily reset from the browser options, or it could be much more serious and due to a trojan or other malware infection on your machine. Without knowing more, it’s hard to tell.
  
  Log in to Reply
Kevin

January 15, 2011

How do these types of sites even get past Google's supposed strict QC in Adwords? Clearly it's a scam since it leads people to believe it's what they are looking for and end up on something totally different from what they searched for. Isn't that a breach of Google's TOS? Or is it because the are paying top dollar hence Google is happy without a care?

n.b. back-link removed as the Philippine IP address country does not match the Swedish site URL! (SP)

Log in to Reply
Not Kevin

January 6, 2011

Interesting, looks like these are all on the same server:

Automatedhomeprofits.com

Elitewealthpackage.com

Home-online-jobs.org

news9online.org

momsincomesystem.com

news9today.org

quickcashkit.net

PaidSurveysGroup.com

Automatedhomeprofits.com is registered to:

Dotcom Internet Marketing

Telephone: 480 304 5449

Station House

North Street

Havant, PO9 1QU
http://whois.domaintools.com/automatedhomeprofits…

PaidSurveysGroup.com has the same address in their terms and conditions:

Paid Surveys Group

Dot Com Internet Marketing Limited.

Registered Office: Station House, North Street, Havant, PO9 1QU

Email: csupport(@)paidsurveysgroup.com

Phone: 480-304-5449

Companies House shows a:

DOTCOM INTERNET MARKETING LIMITED

STATION HOUSE

NORTH STREET

HAVANT

HAMPSHIRE

UNITED KINGDOM

PO9 1QU

Company No. 06928823

Date of Incorporation: 09/06/2009

Log in to Reply
1. Strangely
  
  January 7, 2011
  
  Funny thing, @Not Kevin…. have you ever tried to do a Google search on any of these domains (and similar)?
  
  Almost without exception, they NEVER come up in the search results as a domain but nearly always linked to some consumer complaint type thing!
  
  You'd think that most websites would want to publicise their existence, wouldn't you? Not so with the fake news & blog sites and other web slime. The seek to live in the shadows. All the News9 ones even redirect to CNN!
  
  Another recent addition to the marketing techniques that I've just noticed is the "secret link" down at the bottom next to the T&Cs. This is similar to0 the "please don't go" popup in that they are "pleased" that you've spotted the link and are obviously an astute person as you must be checking the T&Cs, so as a bonus, you can buy "insert rubbish product name here" at the reduced price of "insert made up amount here" for being so clever!
  
  It's another trap to butter up the sucker by pandering to his or her ego.
  
  Log in to Reply