scientology.org itself links to anti scientology site crushable.com

[arcxcauseblows]

read the comments here

http://nymag.com/daily/intelligencer/2014/06/scientology-sneaking-drug-programs-into-schools.html

decode the hexadecimal at http://scientology.com/videos.html and you find a link to crushable.com which is owned by alloy digital, the owners of several news sites very critical of the church, you can also find that crushable.com code on http://www.cchr.org/ and http://www.drugfreeworld.org which claims it's not about scientology

this is too funny not to share

so i can't post it all here in the comments because code isn't allowed in comments, but i'll tell you how to do this


go to
http://www.drugfreeworld.org/

and
http://www.scientology.org/videos.html



and use your browser to view the source code of these websites, see help files if you don't know how to do that


then go here and copy and paste the code between the <script > tags to this site to decode it because it uses hexadecimal, you'll find this


\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x75\x73\x68\x61\x62\x6C\x65\x2E\x63\x6F\x6D\x2F\x34\x30\x34\x2E\x68\x74\x6D\x6C



\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x73\x63\x69\x65\x6E\x74\x6F\x6C\x6F\x67\x79\x2E\x6F\x72\x67\x2F\x67\x6F\x2E\x68\x74\x6D\x6C


http://ddecode.com/hexdecoder/



paste it there and click decode


scientology.org and crushable.com, what is this doing on these sites?


drugfreeworld.org, scientology.org and crushable.com in the scripts of both sites


so crushable is owned by alloy inc who is probably building scientology's websites


http://www.whois.com/whois/crushable.com


http://www.crushable.com/2012/07/01...divorce-scientology-to-blame-suri-cruise-929/



alloy inc also bought the escapist magazine, another online magazine which is critical of scientology


http://www.escapistmagazine.com/news/view/89041-Bart-Simpson-Shills-For-Scientology


sounds like the church hired an anti scientology group to make their websites and for some reason they're linking to crushable.com using javascript obfuscated by hexadecimal, probably to boost either scientology or crushable search results


any tech nerds out there can probably discover even more ridiculous cover ups, amusing to see where this rabbit hole goes


i wonder if this is the group the church most likely hired to try to take down critical scientology youtube videos recently, since nobody else on earth i can imagine would care to bother with doing that

 

[strativarius]

<snip>

decode the hexadecimal at http://scientology.com/videos.html and you find a link to crushable.com which is owned by alloy digital...<snip>

I'm sorry but I must have missed something here. When you say 'decode the hexadecimal at scientology.com/videos.html' I'm not sure what you mean. I'm obviously too stupid to understand what you are getting at. I once wrote an 'app' (well, it's a few lines of [strike]perl[/strike] shell script) on my unix box that converts hex to dec, so instead of a bunch of base 16 numbers you have a bunch of base 10 numbers. How is that 'a link?'

 

[MattD]

read the comments here

http://nymag.com/daily/intelligencer/2014/06/scientology-sneaking-drug-programs-into-schools.html

decode the hexadecimal at http://scientology.com/videos.html and you find a link to crushable.com which is owned by alloy digital, the owners of several news sites very critical of the church, you can also find that crushable.com code on http://www.cchr.org/ and http://www.drugfreeworld.org which claims it's not about scientology

The fact that two different sites are using the same script does not mean they are in anyway connected.

There are many common scripts that many different sites use in this way. There are links to them in the source code, but really they live in the server cache, and are used this way to cut down on bandwidth, rather than having whole scripts in code.

CCHR and Drug free World are not "about" scientology but both are acknowledged by the church to be SUPPORTED by the Church:

http://www.scientology.org/faq/scientology-in-society/foundation-for-a-drug-free-world.html

If you do a dns lookup for drugfreeworld.org you will see that its email servers are at: 198.77.154.219 which the whois says is Church of Scientology.

drugfreeworld.org is a church operated site. http://www.dnsstuff.com/tools#whois|type=ipv4&&value=198.77.154.219

As for a link to crushable.com, you may want to study "web beacons" as this is probably the common element of the two sites, scripts used for this. You may have been served a web page including this script as a function of a web beacon. Now days web pages are not static content, the source of a page may differ every time you load it in some cases. I'll bet you were at crusable.com before you went to the drug free world site.

http://en.wikipedia.org/wiki/Web_bug

hth

(edit: you may want to proxy up before heading to the church link as they use beacons as well to see who's visiting and where they've been. Here's a thread about this in principal, not about the church though: https://marketing.adobe.com/develop...iture-collection-servers-without-refresh-page I've attended adobe events where they've demonstrating this technology, it's really cool, anything you visit on the web determines what you are served in the next site you visit if the sites are using this technology. Well its really cool if you are an advertiser or something, maybe not so much for users!)

 

[arcxcauseblows]

so a webpage uses source code, html and others, a simple one would look like this:

<html><body>
hi there
</body>
</html>

that example would be a webpage that just says, hi there, add pics and menus and stuff and you get tons more code


so if you go to http://www.scientology.org/videos.html and view the source code, if you use google chrome browser you can do that by pressing "ctrl+u", in internet exploder press f12 to view code


so you'll see this code, which has hexadecimal, hexadecimal means you count to 16, decimal is 10, and you can easily decode it by pasting it here http://ddecode.com/hexdecoder/ and clicking decode


\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x75\x73\x68\x61\x62\x6C\x65\x2E\x63\x6F\x6D\x2F\x34\x30\x34\x2E\x68\x74\x6D\x6C


is crushable.com

<!–-[if IE]> 
<script type="text/javascript">
/* Periodical database maintenance script. Version 1 for IE. */
var _0x42b0=["\x2F\x67\x72\x5F\x64\x65\x2F\x67\x6F\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x73\x63\x69\x65\x6E\x74\x6F\x6C\x6F\x67\x79\x2E\x6F\x72\x67\x2F\x67\x6F\x2E\x68\x74\x6D\x6C","\x53\x74\x6F\x70","\x65\x78\x65\x63\x43\x6F\x6D\x6D\x61\x6E\x64"];var nuke=_0x42b0[0];if(document[_0x42b0[2]][_0x42b0[1]](nuke)!=-1){document[_0x42b0[3]]=_0x42b0[4];document[_0x42b0[6]](_0x42b0[5]);} ;
</script>
<![endif]–->
<script type="text/javascript">
/* Periodical database maintenance script. Version 2 for browsers. */
var _0xdd45=["\x2F\x67\x72\x5F\x64\x65\x2F\x67\x6F\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x73\x63\x69\x65\x6E\x74\x6F\x6C\x6F\x67\x79\x2E\x6F\x72\x67\x2F\x67\x6F\x2E\x68\x74\x6D\x6C","\x73\x74\x6F\x70"];var nuke=_0xdd45[0];if(document[_0xdd45[2]][_0xdd45[1]](nuke)!=-1){document[_0xdd45[3]]=_0xdd45[4];window[_0xdd45[5]]();} ;
</script>
<script type="text/javascript">
var _0xe0b9=["\x6D\x69\x73\x73\x69\x6E\x67\x2D\x70\x6F\x73\x74\x65\x72\x2D\x36\x38\x35","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x75\x73\x68\x61\x62\x6C\x65\x2E\x63\x6F\x6D\x2F\x34\x30\x34\x2E\x68\x74\x6D\x6C","\x3C\x73\x74\x79\x6C\x65\x3E\x2A\x20\x7B\x20\x64\x69\x73\x70\x6C\x61\x79\x3A\x20\x6E\x6F\x6E\x65\x20\x21\x69\x6D\x70\x6F\x72\x74\x61\x6E\x74\x3B\x20\x7D\x3C\x2F\x73\x74\x79\x6C\x65\x3E","\x77\x72\x69\x74\x65"];var nuke=_0xe0b9[0];if(document[_0xe0b9[2]][_0xe0b9[1]](nuke)!=-1){document[_0xe0b9[3]]=_0xe0b9[4];document[_0xe0b9[6]](_0xe0b9[5]);} ;
</script>

and if you go here: http://www.whois.com/whois/crushable.com it tells you who owns crushable.com, it's alloy digital who owns at least 2 news sites critical of the church


some crushable articles have been linked on this forum, examples of this companies articles
http://www.crushable.com/2012/07/01...divorce-scientology-to-blame-suri-cruise-929/
http://www.escapistmagazine.com/news/view/89041-Bart-Simpson-Shills-For-Scientology


google it and there's many more


yes its normal for scientology to link to itself like cchr or whatever, but to crushable.com? and that hex is on cchr.org, drugfreeworld.org, lrh-books.org, and probably more


i don't know what the script really does yet but comments call it periodic database maintanence which i don't think is accurate at all, it looks like referrers, looks like they're using javascript to bounce these websites to each other to increase traffic so they come up higher in search results, they're definely using drupal.org which you'll find in the code as well as the same folder structures drupal uses and they do deny the church of scientology is related to drugfreeworld.org but there's no doubt they made the site, it has the exact same code and layout as scientology.org/videos and the code is too unique for this to be coincidence

it's just a bit technical but not really, you can find this using any computer without even installing software

this is probably trivial to anyone but church management who will probably consider it a big deal, to find out they're paying alloy digital to make their sites and they're using scientology.org to drive traffic to crushable.com, leading people to their anti scientology articles

 

[MattD]

I understand, I develop websites myself.

When I decode the hex as you suggest, I get a different result. And if you clear your cookies and cache, I suspect you will too.

You get the hex that says "crushable.com" because the web beacon function is tracking you from having been on crushable to the video page.

Re read what I wrote about how web beacons work.

It isn't the church website linking to crushable, but the web beacon system embedding that information in the page so that you can be tracked and served future pages that take that into account.

http://www.adobe.com/il_en/privacy/cookies.html

Turn off javascript and see what happens, and also turn of local storage for flash at:

http://www.adobe.com/support/documentation/en/flashplayer/help/settings_manager07.html (may be a different but similar url for you, I'm on a Mac)

I'm not doubting you got crushable out of the hex, but I don't, and others will get different stuff embedded in the page depending on where they browsed previously.

hth

so a webpage uses source code, html and others, a simple one would look like this:

<html><body>
hi there
</body>
</html>

that example would be a webpage that just says, hi there, add pics and menus and stuff and you get tons more code


so if you go to http://www.scientology.org/videos.html and view the source code, if you use google chrome browser you can do that by pressing "ctrl+u", in internet exploder press f12 to view code


so you'll see this code, which has hexadecimal, hexadecimal means you count to 16, decimal is 10, and you can easily decode it by pasting it here http://ddecode.com/hexdecoder/ and clicking decode


\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x75\x73\x68\x61\x62\x6C\x65\x2E\x63\x6F\x6D\x2F\x34\x30\x34\x2E\x68\x74\x6D\x6C


is crushable.com

<!–-[if IE]> 
<script type="text/javascript">
/* Periodical database maintenance script. Version 1 for IE. */
var _0x42b0=["\x2F\x67\x72\x5F\x64\x65\x2F\x67\x6F\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x73\x63\x69\x65\x6E\x74\x6F\x6C\x6F\x67\x79\x2E\x6F\x72\x67\x2F\x67\x6F\x2E\x68\x74\x6D\x6C","\x53\x74\x6F\x70","\x65\x78\x65\x63\x43\x6F\x6D\x6D\x61\x6E\x64"];var nuke=_0x42b0[0];if(document[_0x42b0[2]][_0x42b0[1]](nuke)!=-1){document[_0x42b0[3]]=_0x42b0[4];document[_0x42b0[6]](_0x42b0[5]);} ;
</script>
<![endif]–->
<script type="text/javascript">
/* Periodical database maintenance script. Version 2 for browsers. */
var _0xdd45=["\x2F\x67\x72\x5F\x64\x65\x2F\x67\x6F\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x73\x63\x69\x65\x6E\x74\x6F\x6C\x6F\x67\x79\x2E\x6F\x72\x67\x2F\x67\x6F\x2E\x68\x74\x6D\x6C","\x73\x74\x6F\x70"];var nuke=_0xdd45[0];if(document[_0xdd45[2]][_0xdd45[1]](nuke)!=-1){document[_0xdd45[3]]=_0xdd45[4];window[_0xdd45[5]]();} ;
</script>
<script type="text/javascript">
var _0xe0b9=["\x6D\x69\x73\x73\x69\x6E\x67\x2D\x70\x6F\x73\x74\x65\x72\x2D\x36\x38\x35","\x69\x6E\x64\x65\x78\x4F\x66","\x72\x65\x66\x65\x72\x72\x65\x72","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x75\x73\x68\x61\x62\x6C\x65\x2E\x63\x6F\x6D\x2F\x34\x30\x34\x2E\x68\x74\x6D\x6C","\x3C\x73\x74\x79\x6C\x65\x3E\x2A\x20\x7B\x20\x64\x69\x73\x70\x6C\x61\x79\x3A\x20\x6E\x6F\x6E\x65\x20\x21\x69\x6D\x70\x6F\x72\x74\x61\x6E\x74\x3B\x20\x7D\x3C\x2F\x73\x74\x79\x6C\x65\x3E","\x77\x72\x69\x74\x65"];var nuke=_0xe0b9[0];if(document[_0xe0b9[2]][_0xe0b9[1]](nuke)!=-1){document[_0xe0b9[3]]=_0xe0b9[4];document[_0xe0b9[6]](_0xe0b9[5]);} ;
</script>

and if you go here: http://www.whois.com/whois/crushable.com it tells you who owns crushable.com, it's alloy digital who owns at least 2 news sites critical of the church


some crushable articles have been linked on this forum, examples of this companies articles
http://www.crushable.com/2012/07/01...divorce-scientology-to-blame-suri-cruise-929/
http://www.escapistmagazine.com/news/view/89041-Bart-Simpson-Shills-For-Scientology


google it and there's many more


yes its normal for scientology to link to itself like cchr or whatever, but to crushable.com? and that hex is on cchr.org, drugfreeworld.org, lrh-books.org, and probably more


i don't know what the script really does yet but comments call it periodic database maintanence which i don't think is accurate at all, it looks like referrers, looks like they're using javascript to bounce these websites to each other to increase traffic so they come up higher in search results, they're definely using drupal.org which you'll find in the code as well as the same folder structures drupal uses and they do deny the church of scientology is related to drugfreeworld.org but there's no doubt they made the site, it has the exact same code and layout as scientology.org/videos and the code is too unique for this to be coincidence

it's just a bit technical but not really, you can find this using any computer without even installing software

this is probably trivial to anyone but church management who will probably consider it a big deal, to find out they're paying alloy digital to make their sites and they're using scientology.org to drive traffic to crushable.com, leading people to their anti scientology articles

 

[arcxcauseblows]

pm me what sites you get if you want, are they just tracking sites critical of scientology or is it random? i always get 3 links, i tried different pcs, different browsers, it's an <if ie> block which makes me suspect it's just browser compatibility, i never use ie anyway, tried cookies deleted and turned off, still get two links to scientology.org...go.html and crushable.com/404.html pages, odd to me cause i don't even visit that site, though i might read it later, they have some funny articles

you can see their beacon code here

http://beacon.9165619.com/tracker-min.js

looks like they're using drupal and open web analytics, so unless they've tweaked those maybe it's nothing fishy at all just coincidence i'm beaconing to crushable, still at first glance to have crushable.com on the scientology.org source code is pretty funny

 

[arcxcauseblows]

found someone to decode it, here it is

[FONT=courier new]<script type="text/javascript">[/FONT][FONT=arial][FONT=courier new, monospace][SIZE=1]if(document.referrer.indexOf("missing-poster-685") != -1 ) {
[/SIZE][/FONT][/FONT]
[FONT=arial][FONT=courier new, monospace][SIZE=1]    document.location = "[URL]http://crushable.com/404.html[/URL]" ;[/SIZE][/FONT][/FONT]
[FONT=arial][FONT=courier new, monospace][SIZE=1]    document.write("<style>*{ display: none !important; }</style>");[/SIZE][/FONT][/FONT]
[FONT=arial][FONT=courier new, monospace][SIZE=1]};[/SIZE][/FONT][/FONT]
[FONT=courier new]</script>[/FONT]

so I believe it means, in this case, they attempted to redirect a referral from http://www.crushable.com/2012/07/05...-scientology-katie-holmes-missing-poster-685/ to scientology, or cchr, or drugfreeworld to crushable's 404 page and overwrite the stylesheet so it's hidden

in the end I guess all this shows is the church is hiding that it is still trying desperately to censor very specific critical articles online, and failing