MF-2026-0812

MF-2026-0812 — SEO Poisoning Attack on Japanese Medical Websites

🔴 ACTIVE INCIDENT — Published for public benefit. All IoCs freely usable for defensive purposes.

A 4-month planned, dual-leverage SEO poisoning attack against Medi Face, Ltd. (株式会社Medi Face / 医療法人鳳應会グループ) and 20 other Japanese medical websites.
Victim contacts: info@medi-face.co.jp · Reference: MF-2026-0812

Read the Full Technical Paper

Language	Format	Description
🇬🇧 English	MF-2026-0812_en.html	Complete technical paper — all 9 sections, full JS cloaking engine source, game-theoretic analysis
🇯🇵 日本語	MF-2026-0812_ja.html	完全技術解析論文 — 全9章、完全JSクローキングエンジンソース、ゲーム理論分析
📄 IoCs (machine-readable)	iocs.txt	All indicators of compromise in plain text

Summary

Attack type: PHP webshell → WordPress DB SEO poisoning → Cloudflare Pages brand impersonation → geo-cloaked redirect → illegal Indonesian gambling sites
Attacker origin: Indonesia (primary IP: 182.10.98.57, Biznet/Telkom) + Iranian secondary operator
Mastermind connection-origin: Tokyo, Japan (Nagatacho/Roppongi area — behind Indonesian proxy)
Infrastructure planning: Began 2026-04-04 (120 days before attack)
Victims: 21 Japanese medical websites on CORESERVER (REDACTED)

Attack Chain

Legitimate medical sites (21 domains)
    ↓  [PHP webshells: fgh.php + 5 others]
WordPress DB injection (Schema.org LD+JSON gambling code, 130+ pages)
    +
Google Search Console hijack (stolen HTML verification token)
    ↓
medi-face.pages.dev / fraise-clinic.pages.dev  [Cloudflare Pages brand impersonation]
    ↓
jutsu-seribu-bayangan.pages.dev / wewillrockyou.pages.dev  [geo-cloaking engines]
  → Indonesian mobile only → terreagoodboy.store / bringmetolife.store
  → Everyone else  → harmless self-loop (evidence destruction)

Quick IoC Reference

# PRIMARY ATTACKER IPs
182.10.98.57     # Indonesia — initial webshell activation 19:33:27 JST
103.20.83.86     # Indonesia — highest frequency
31.56.30.60      # Iran — secondary operator

# MALICIOUS DOMAINS
jutsu-seribu-bayangan.pages.dev   # cloaking engine A [RESTRICTED by Cloudflare]
wewillrockyou.pages.dev           # cloaking engine B [RESTRICTED by Cloudflare]
medi-face.pages.dev               # brand impersonation A [under review]
fraise-clinic.pages.dev           # brand impersonation B [under review]
bringmetolife.store               # gambling destination
terreagoodboy.store               # gambling destination

# AFFILIATE IDs (attacker revenue)
cSyJDyLy
MKPA2AD00002

# GSC VERIFICATION TOKEN (attacker-controlled)
2Z_wOjQcGzVd53eRds3fVWKSAaDsyNsUl7AsNymx4tc

# WEBSHELL FILENAMES
fgh.php  yomanx498.php  n0bgxdjskd.php  mails.php  follder.php  carrier/sshy.php

→ Full IoC list: iocs.txt

Detection: Are You Affected?

# 1. Search for webshells
find /home/ -name "fgh.php" -o -name "yomanx498.php" -o -name "mails.php" -o -name "follder.php"
find /home/ -name "*.php" -newer /path/to/wp-config.php

# 2. Check WordPress DB for gambling code
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%bringmetolife%' OR post_content LIKE '%cSyJDyLy%' OR post_content LIKE '%SULEBET%';" --path=/path/to/wp

# 3. Check Google Search Console
# Settings → Users and permissions → remove unknown accounts
# Check for unauthorized google-site-verification meta tags

# 4. Google site: search
# Search: site:yourdomain.com SULEBET
# If results appear → you are affected

Response Actions Taken

Action	Status
Webshells (6 files) removed	✅ Complete
Gambling code removed from DB (130+ pages)	✅ Complete
JPCERT/CC incident report	✅ Filed
Tokyo Metropolitan Police (Cybercrime Div.)	✅ Filed
Cloudflare abuse reports (4 Pages projects)	✅ Filed
Cloudflare restrictions	✅ 2 of 4 restricted
Netcraft phishing reports (4 UUIDs)	✅ Filed
Google spam report	✅ Filed
NameCheap abuse report	✅ Filed

Why Full Public Disclosure?

This is not opportunistic cybercrime. It is a 4-month planned, dual-leverage operation:

Revenue stream 1: Affiliate commissions from Indonesian gambling sites (immediate)
Revenue stream 2: Building permanent false evidence that the victim operates an illegal casino — usable as leverage (long-term)

Game-theoretic analysis (von Neumann) shows that complete public disclosure is the defender’s dominant strategy. The attacker’s leverage evaporates the moment it becomes public. This repository is the execution of that strategy.

See Section 7 of the full paper for the formal payoff matrix analysis.

Contact & Collaboration

If you have found the same attacker infrastructure targeting other organizations, or have additional information:

Medi Face, Ltd.
Email: info@medi-face.co.jp
Reference: MF-2026-0812

Findings can also be shared with:

JPCERT/CC — Japan CSIRT
ID-SIRTII/CC — Indonesia CSIRT
Cloudflare abuse

License

CC0 1.0 Universal — Public Domain

All IoCs, code samples, and analysis in this repository are released to the public domain. No attribution required. Use freely for defensive, research, and investigative purposes.

The goal is to protect other organizations. Share widely.