Sucuri malware analyst Kaushal Bhavsar recently brought our attention to a massive campaign responsible for adding either “1800ForBail” or “1800ForBail – One+Number” keywords to the titles of vulnerable WordPress sites.
1800ForBail in Search Results
Google currently returns 158,000 results for the [intitle:1800ForBail] query.
Of course, this count includes internal pages on compromised websites.
At the same time, PublicWWW.com returns 692 results for “1800ForBail”, where one result per domain is typically listed.