Meatspin

Meatspin
Meatspin is a shock site showing a looping video of a transexual woman and a man having anal sex. The woman's penis is spinning, hence the name Meatspin. The 2003 edit of "You Spin Me Right Round" by Dead or Alive plays in the background. There is a spin counter that tells you how many spins you've gone through. If the spin counter reaches over 45 spins, a text box appears saying YOU ARE OFFICIALLY GAY :-). A variation of this website exists but with Three 6 Mafia's "Ridin' Spinners" playing instead.

There are variants of this site which contain scripts that will let the window bounce around the screen and display alot of message boxes when the user tries to close the page.

Google Hammer
Google Hammer is the most malicious variant of Meatspin. It tries to trick people into thinking they will find good value marketing information, however when visitng the site, it sometimes will show a fake loading page, then it will proceed to the main payload which is showing the Meatspin flash, letting the window move around the screen. When the user tries to close the page, a second payload will be activated which is crashing non-IE browsers such as Chrome by overloading Shockwave Flash using a custom SFWObject script, displaying alot of confirm boxes, and changing the window title on IE on exit. Before it used its own code, the website was a mirror to Makemoniesonline.com which is basically the same (Not as malicious though.) Many people think that the website will download a bunch of malicious applications to the local machine, however this statement was confirmed false.

Links
NOTE : The following websites contain pornographic images.
 * meatspin.fr

Mirrors

 * discharges.org/ridin/spinnaz.swf (Ridin' Spinners version)
 * ridinspinnas.ytmnd.com/ (same thing as above)
 * meatspin.titsnbeer.com
 * web.archive.org/web/20110727163058/www.wowomg.com/
 * web.archive.org/web/20090120183651fw_/makemoniesonline.com/ (Makemoniesonline)
 * web.archive.org/web/20130104182051/googlehammer[.]com/ (Google Hammer)
 * web.archive.org/web/20090303152024/infoslash.net/ (Another version with a malicious script)
 * geocities.ws/geomugen/index.html (Safe Version)