ordercustompaper and customwritings hacking links and scam

there are reports all over the place about ordercustompaper.com being a scam, so i wont get into that right now. i however wanted to bring up the fact that ordercustompaper.com and customwritings.com generates links (for high google serps) by hacking web servers using XSS and other means, and posting their links in the footer of the hacked domain names.

According to another post on this website, It's ran by the same people who run the following:

academicexperts.us
advancedwriters.com
affordablepapers.com
bestessaytopics.com
blogscribes.com
buycollegepaper.com
buyessay.org
buyresearchpaper.net
buytermpaper.net
custom-writings.com
customwritings.com
customwritingservice.com
essay-answers.com
essayforyou.com
essaylib.com
essaymoney.com
essaymonitoring.com
essaysexperts.com[DND*]
gpalabs.com
gradelancer.com
historypapers.org
lawpapers.net
livepaperhelp.com
mastersthesiswriting.com
midterm.us
ordercustompaper.com
orderessay.net
plagiarismdetect.com
primewriters.com
revisionlabs.com
thepensters.com

More information on bot it uses to control the hacked domains:

For its spam , it connects to and speaks with "db.linkfeed.ru" , got it from linkfeed.php

part of the file:

"class LinkfeedClient {
var $lc_version = '0.3.8';
var $lc_verbose = false;
var $lc_charset = 'DEFAULT';
var $lc_use_ssl = false;
var $lc_server = 'db.linkfeed.ru';
var $lc_cache_lifetime = 3600;
var $lc_cache_reloadtime = 300;
var $lc_links_db_file = '';
var $lc_links = array();
var $lc_links_page = array();
var $lc_links_delimiter = '';
var $lc_error = '';
var $lc_host = '';
var $lc_request_uri = '';
var $lc_fetch_remote_type = '';
var $lc_socket_timeout = 6;
var $lc_force_show_code = false;
var $lc_multi_site = false;
var $lc_is_static = false;

"

it then stores the spam links in a file called "linkfeed.links.db" (i think)

these files are going to be stored in /images/0146d2f3sa38a380d2cf5441o4b14f0ffc320d or something random like that.

Then your index file will have like 10 lines starting with "<? $GLOBALS['_581978928_']=Array(base64_decode('' .'Z' .'GVm' .'aW5' .'l'))" and a lot of base64 stuff you need to decode. It contains the linkfeed username, the document root directory, location of the linkfeed.php file, and a few other things..

more info on the remote shell later

Also im sorry about this turning technical, but i figured this was the best place to let the public know that ordercustompaper.com hacks domain names for traffic

More information on the backdoor that ordercustompaper.com and their partner sites install:

Parts of the backdoor script (this script is not very smart and thus it wont work on 99% of the hosting accounts out there.. but fact remains is ordercustompaper.com tried to install it)

(this is just parts of a few files)
#####################################
# ShElL V2 #
# mantap jaya #
# jatimcom #
#####################################
$sh_id = "SkFUSU0gQ09NTVVOSVRZ";
$sh_name = base64_decode($sh_id);
#$sh_mainurl = "jatimcom .uni.cc";

They also installed adminer.org (simple database management script) onto the server.

Do NOT use ordercustompaper.com or any of their partner sites. I just posted how they hack websites to spam links to generate high google rankings (the reason you found them in the first place)

ordercustompaper.com and the other sites listed will also rip you off according to other reports on this board and many others. do your research first.

Hacking is a FEDERAL CRIME that carries very serious felony charges. The fraudulent owners of Brownie Freelance are well-known scammers from Ukraine who do not respect American/British laws and regulations. Because they have engaged in hacking, ALL of their .com, .net, .org, and .us domain names can be seized via a court order to ICANN. Victimized site owners can arrange the seizure of the Brownie Freelance sites by contacting the Office of the Attorney General in the state in which each respective victim lives.

Make no mistake about it, this crime can and will take down that entire ripoff company if victims pursue action.

Carefully archive ALL evidence, regardless of how small or insignificant that a particular piece of evidence may seem. Of critical importance are the actual source code used in the attacks, domain names, email addresses, IP addresses, servers, names, country affiliations, etc.

Seems to me that nothing came of the highly intricate report the OP provided. Nobody sued ordercustompaper and customwritings because, maybe it never occurred to the OP, the other sites were in on the deal. They struck a deal as one con man to another to benefit their respective businesses. How and what the deal was about we will never know. The fact that nobody tried to contradict the report and, nobody tried to get the companies on the DND list of this site means that those involved have chosen to simply let the issue die a natural death, thus protecting their own company interests as well.

I have no idea what comprises a Platinum Writing Package or why a company known for hijacking code would offer it. Since the company has been outed as a scam, it is important that students note the information in the OP and also, understand that there are grounds to not trust any high profile services they choose to offer. Their services areaswere ploy for their actual intent I bet those who tried their services learned their lesson the hard way.