they just put a lot of intriguing content (porn?) on there with a trojan or two sprinkled around and waited for the curious monkey - er user - to click on it.