Whether or not this is the result of the recent compromise of one of the hosting provider's database servers is unknown.
The hijacked websites contain a PHP page redirecting visitors to a website hosting a "get rich working from home" scam. On that site there are also fake Google AdSense ads that all link to a YouTube lookalike site showing videos that promote an online gambling site.
The scheme was first discovered on Friday, and the domain in question has obviously been blocked in the meantime, forcing scammers to redirect users first to similar domains that contained absolutely nothing, and currently to a service that supposedly tells users all about their ancestors and family links:
To do that, the users are asked to share their first and last names, the names of their father and mother (including her maiden name), their nationality, their and their parents' place of birth, and their date of birth.
They are then presented with a short summary of the information the site can provide: photos, diplomas, letters, and more. But, in order to see specific information, the users are required to activate the service by sending an SMS to a specific number and share their phone number.
Oh, and by the way - the service costs some 600 rubles (around $20) per month, and this particular piece of information can only be read by those wise enough to scroll way down the page.
And while this service does seem to be legitimate, the practice of making the fees difficult to spot is unfair to the customers. And it is also possible that the collected information is sold to third parties or used by the people behind the service to send out spam or orchestrate social engineering attacks.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.