Software security company Sunbelt blogged about how the attack was generated: a network of spambots apparently added links into blog comments and forums pointing to the bad sites over a period of months in some cases, enabling those sites to achieve fair rankings in search engine result pages for a great many potential keyword search combinations. The pages either contained iframes which attempted to load malware onto visitors machines or perhaps they began redirecting to the sites containing malware at some point after achieving rankings. Sunbelt provided interesting screenshots of the SERPs in Google:

(click to enlarge)

And also showed some screenshots of some of the keyword-stuffed pages which apparently got indexed:

(click to enlarge)

I think it’s not at all a coincidence

(more…)