Red Hen website suffers SEO spam compromise

Malware Bytes Labs ^ | 27 June 2018 | Christopher Boyd

[COBOL2Java]

---

If you’re thinking about checking out the website owned by the restaurant that asked White House press secretary Sarah Huckabee Sanders to leave the premises, you might want to hold off. There’s some site compromise action afoot.

Although the homepage appears to be acting in a perfectly normal manner, turning off scripts so you can see what’s happening under the hood provides a rather stark visual discrepancy.

Visiting as normal:

Visiting with scripts turned off:

Why yes, that’s a collection of Viagra spam text injected into the website with the aim of giving a search engine boost to the sites linked. What you’re seeing here is the otherwise “hidden” code leaking through onto the page; it actually resides in the HTML source like so:

The sites hoping to get a search engine boost from the compromised restaurant page are pushing pharmaceuticals. Here’s the first example, a shopping portal for Generic Viagra:

The second is for a prescription drug I’m not even going to attempt to pronounce:

Old hat

This is an absolutely ancient black hat tactic, most typically referred to as a form of SEO (Search Engine Optimisation) spam, or “Spamdexing.” Threat actors either use dirty SEO tactics to drive high traffic to their pages or they capitalize on already highly-trafficked targets by hiding their links in subtext.

[Kozy]

Very overpriced. Soon half price on everything as they hold their going out of business sale

[conservativesister]

How many times have we heard:

“Actions have consequences”

Hopefully she now understands that.

[jonrick46]

For the price and the view (yes, you can go out and eat on the deck), my local seafood restaurant also has great beef. This is their grilled ribeye you get for $4s more ($32.95):

This is the view:

[Texas resident]

Either way it was a very DUMB business decision.

Everyone’s money is green despite their differences.

Guess she wants to cater to only her kind.

Good luck with that.