I know this guy, and his wordpress site got repeatedly filled up with
hidden meds (viagra, etc) links. I investigated this, and it seems the perpetrator exploits a site and creates a site-in-site, hidden somewhere. Then other sites are exploited are used to bring PageRank to the main exploited site. From what I can tell it seems a foreign affiliate site, the third site, that finally redirects and counts the clicks to the final destination.
1) First hop -- hidden links on a WordPress site pointing to:
2)
http://www.arttodaygallery.com/vinod/?glasso=1&page=553 an exploited site containing a hidden site in thee the /vinod dir, pointing to:
3) third hop is a Djibouti site, uniquetracker.dj, that seems to be the affiliate site that tracks the clicks and redirects to the final
4) Fourth and final hop, the e-commerce site
Now, in the first hop site at the end of the links there is an adsense PUB number: pub-7652328300112265
Now if you google this like I did, you get:
http://www.google.com/search?client=safari&rls=en&q=pub-7652328300112265&ie=UTF-8&oe=UTF-8which brings you to this site:
http://forums.searchenginewatch.com/showthread.php?p=136248which unfortunately brought me here:
http://forum.amule.org/?viewtopeg=1&page=991where by clicking enter:
http://forum.amule.org/?viewtopeg=1&page=107?highlight=Celebrex
Wish you luck getting to the bottom of this, and I'll keep you updated if I discover anything.
