So I was searching for a supplement online, and found a link on the first page of Google to an American university's department of medicine website.
When you click on the cached version it shows what looks like a version that once existed on the department's website with all the spam text. However when you click on the live version on Google it immediately redirects to a different website (which includes different spam text).
This made me wonder how this works. I doubt the spammer still (if they ever did) has access to the university's domain manager (although I suppose this is possible) and redirected the specific url (the one found on Google) from the domain manager. Because if that is what the spammer did, wouldn't it likely already be fixed, given that the cached version of the website is no longer the live version (indicating perhaps that the university recognized they were compromised and fixed the page)?
But if the university fixed the page (i.e. deleted it, as it is an unique URL made specifically for the spam and not a preexisting one), wouldn't they have also probably realized that there is code somewhere on the site causing it to redirect immediately to another domain? Or that someone accessed their domain manager and has a domain redirect set up?
Does it seem like they likely at some point had their spam posted on the live version of the university's website and also had a redirect set up either via the domain manager or code on the site?
Unsure if I am allowed to include the specific link or university's name.
When you click on the cached version it shows what looks like a version that once existed on the department's website with all the spam text. However when you click on the live version on Google it immediately redirects to a different website (which includes different spam text).
This made me wonder how this works. I doubt the spammer still (if they ever did) has access to the university's domain manager (although I suppose this is possible) and redirected the specific url (the one found on Google) from the domain manager. Because if that is what the spammer did, wouldn't it likely already be fixed, given that the cached version of the website is no longer the live version (indicating perhaps that the university recognized they were compromised and fixed the page)?
But if the university fixed the page (i.e. deleted it, as it is an unique URL made specifically for the spam and not a preexisting one), wouldn't they have also probably realized that there is code somewhere on the site causing it to redirect immediately to another domain? Or that someone accessed their domain manager and has a domain redirect set up?
Does it seem like they likely at some point had their spam posted on the live version of the university's website and also had a redirect set up either via the domain manager or code on the site?
Unsure if I am allowed to include the specific link or university's name.