-
Task
-
Resolution: Fixed
-
Normal
Links to Decoda have previously been disabled due to reports of malicious behaviour (MBS-11049)
2 months later this is still an issue: https://musicbrainz.org/edit/74319055
After researching a bit it looks like Decoda (formerly LyricStatus) at one point stopped aiming to be a reputable site, if ever.
First off, the site is no longer moderated. The latest "news" entry is dated 2018 and the older entries are just tests. For a long time even:
https://web.archive.org/web/20160801222454/http://decoda.com/
http://decoda.com/news/decoda-news-titles#11
http://decoda.com/news/the-standard-lorem-ipsum-passage-used-since-the-1500s#16
http://decoda.com/news/the-standard-chunk-of-lorem-ipsum#23
http://decoda.com/news/lorem-ipsum-dolor-sit#34
http://decoda.com/news/html-5-video#42
The newest lyrics additions were made July 2020:
http://decoda.com/yong-yuan-bu-zai-yong-yuan-bu-zai-yong-yuan-bu-zai---power-station-lyrics
http://decoda.com/joe-blandino-joe-blandino-vuelve-lyrics
In June 2013 LyricStatus was rebranded to Decoda
http://decoda.com/press
Despite the company name being changed to "IO PROPERTY LTD" in May 2015
https://find-and-update.company-information.service.gov.uk/company/07711003
the C-Line still says "© 2020 LyricStatus Ltd"
Same for the terms page
http://decoda.com/terms
Let's take a look at the contact page
http://decoda.com/contact
"3DLHoldings" in Ontario, Canada. Weird but on the other hand it's also in WHOIS
Oh look, there is a Wordpress instance:
http://www.decoda.com/wordpress/privacy-policy/
"3dlholdings@gmail.com"
I wonder where else this email is used:
https://viewdns.info/reversewhois/?q=3dlholdings%40gmail.com
mymusicsite.org
onlinedatafile.com
themusicsearch.com
topcelebrityphotos.net
What sites are hosted on same IP?
https://viewdns.info/reverseip/?host=decoda.com&t=1
creativemortgagespecialists.com
decoda.com
everythingcool.net
ironcladsealing.com
lifewithpets.net
lyricsta.com
lyricstatus.com
mastermortgages.ca
memesandjokes.com
mohamedsalahquotes.com
mymusicsite.org
playmusic.net
sharecamp.com
thekingsofmortgages.com
themusicsearch.com
thesportscenter.net
What sites are using their nameservers?
https://www.robtex.com/dns-lookup/ns1.decoda.com#dnsrel
https://www.robtex.com/dns-lookup/ns2.decoda.com#dnsrel
https://viewdns.info/reverseip/?host=ns1.decoda.com&t=1
https://reversens.domaintools.com/search/?q=ns1.decoda.com
Lots of weird SEO sites, some dead or abandoned 🤔
Back to Decoda. Some time between 2014 and 2015 their Google Analytics ID changed
UA-21554196 https://web.archive.org/web/20140225040737/http://decoda.com:80/
UA-55629503 https://web.archive.org/web/20150314191357/http://decoda.com/
Probably at the same time Google Adsense was added: pub-4300090053918000
The links to team page also went missing
https://web.archive.org/web/20140217005326/http://decoda.com/news/team
How did the advertising page change over time?
https://web.archive.org/web/20130328045020/http://www.lyricstatus.com/advertising
https://web.archive.org/web/20130716043149/http://decoda.com/advertising
https://web.archive.org/web/20140218114950/http://decoda.com/advertising
https://web.archive.org/web/20150315010636/http://decoda.com/advertising
Spotted the changes beside the obvious? Hint: The Skype username
It used to be "lyricstatus", now it's "nutsforsports"
Not just the ads stuck out but also some strange "music" sites Decoda is linking to. You will recognize those from DNS data.
https://web.archive.org/web/20150323102549/http://decoda.com/the-beatles-come-together-lyrics
https://web.archive.org/web/20150211004928/http://www.mymusicsite.org/
https://web.archive.org/web/20190722234101/http://decoda.com/the-beatles-come-together-lyrics
https://web.archive.org/web/20160816015821/http://playmusic.net/
I've then found a GitHub repo by some Indians where you can find the source of that site using their GA ID.
https://github.com/Hemant-Mann/Musik/commit/4ef4041e2c12e274ef5a93e82d0b520d948f6a8e
Those Indian folks seem to run a company named "CloudStuff". An archived version of playmusic.net was linking to https://web.archive.org/web/20160805174027/http://cloudstuff.tech/
BTW, their Adsense ID is used by at least two more SEO sites
mortgageloanmanager.com
creditcardvsloans.com
Need one more reason to drop Decoda? Downstream users of MB might not handle the ended attribute and will happily link to them, e.g. BBC: https://www.bbc.co.uk/music/reviews/h3cz/
Here comes the bonus chapter. Who is nutsforsports?
https://www.youtube.com/user/nutsforsports101
https://www.blackhatworld.com/members/nutsforsports.17110/#about
https://swapd.co/u/nutsforsports/summary