Bizzare Website Hijacking

Permalink
A customer just called me to point out some sort of weird hijacking attempt on their C5 website..

They install rain gutters, etc.. and when she did a search on yahoo for "rain gutters, apple valley, ca" , one of the paid results at the top uses her business name with someone elses number..

I figured it was some sort of aggregator or similar. But when I did the search, and started clicking through, it became obvious it was some bizarre imposter website:

Here is their actual website:http://goo.gl/MPqdn

Here is the imposter website (click at your own risk, while I get no warnings, it is possible the site contains malicious software):http://goo.gl/grfDL

The imposter site is completely identical to the C5 site, in design and functionality, with one exception, all of the phone numbers have been changed. Perhaps some script, you would assume... But no, the header has the phone number overlayed as an image, and they manually covered it up!

The weirdest part in all of this is that the telephone number they injected in there is just some random persons phone number in the area..

The base domain of the imposter site is calls.net, and it appears there is absolutely no information on it, or this scam/whatever it is..

I'm just trying to figure out how, whoever it is, is trying to make a dollar, because pay-per-click advertising isn't free..

guythomas
 
guythomas replied on at Permalink Reply
guythomas
Even weirder.. I filled out the contact us form on the imposter site, and the results still went through to the normal site.. It's almost as if they are proxying the regular site as a whole..
andrew replied on at Permalink Reply
andrew
I think that's what they're doing:

http://arstechnica.calls.net/