One of my websites is a directory and when I last ran my link checker about 10 days ago, to validate that the sites were all still valid, several of them triggered a test that I installed to check for hacked sites. After doing a little bit of research they all turned out the be hosted on Apollo Hosting.
What I found were very large blocks of ads embedded in the home page of each compromised site for every kind of pharma product you've ever seen spammed with their links pointing to
landing pages on multiple compromised servers including several universities. Some of the
landing pages are also hosted on Apollo Hosting so they are being used to host both the hackers pharma links and pharma landing pages.
Took a quick look in Google and found a lot of references in Google about
individual sites on Apollo being hacked but I don't think they know the extent of the problem.
Please note that these types of hackers don't seem infect every account on the server, they just infect a chunk of them based on some unknown criteria, so it's hit and miss which domains are infected. Perhaps individual accounts were hacked but I don't think so as I've seen this same type of thing on
iPowerWeb (which now appears cleaned up), random sites, some servers had more sites infected, others just a few, who knows why.
Here's a few examples, view the HTML source to see all the embedded pharma ads typically at the bottom of the page:
Caution: disable javascript before you go to any domainServer: secure1.apollohosting.com
Domains:
http://whois.webhosting.info/206.125.215.251?pi=4&ob=SLD&oo=ASCSample 1: view-source:
http://oceancyclery.com/Sample 2: view-source:
http://oldpeking.com/Server: secure2.apollohosting.com
Domains:
http://whois.webhosting.info/206.125.215.252Sample 1: view-source:
http://armandmercury.com/Sample 2: view-source:
http://altonaequipment.com/Server: secure4.apollohosting.com
Domains:
http://whois.webhosting.info/206.125.215.254View the source on any domain in the list, not all are infected but it's a more
heavily server wide infestation...
So on and so forth, you get the idea.
I spot checked a handful of servers, but based on what I've run across in the past with other similar shared server infestations it's probably on all shared servers.
DISCLAIMER: The sites and servers referenced still contained the pharma ads at the time of this writing and may be cleaned up in the future. Follow the links to check the domains hosted to see if the problem still exists in the future.