2

I was doing some backlink research and found a huge amount of legit websites linking to the site I was researching.

The problem was that the anchor text of all the links where porn related terms.... I investigated further and found out that all of the hundreds sites backlinking were WordPress sites.

I investigated further and checked the source code of many sites, they all had the same procedure, a block of backlinks with porn terms in the anchor text just before the ending of a post block:

<div style="position: absolute; top: -977px;left: -977px;"><a href="http://www.tamtamcrm.com/" title="free gay porn"><img src="" alt="free gay porn"></a></div>
<div style="position: absolute; top: -99999px;right: -99999px;">How To Dress Stylish On A Budget<br />

 <a href="http://www.escales-cargo.com/" title="porn" > porn </a>the closest man to Ted<br />

 <br />Women Friendly Bed and Breakfast Lodgings<br />
 <a href="http://www.israelprograms.com.au/" title="porno" > porno </a>&#8221;But there were novelty designs<br />

 <br />Abercrombie And Fitch Outlet Shelves Trendy Products<br />
 <a href="http://www.usadoslaserena.com/" title="anime porn" > anime porn </a>It then becomes a battle of survival as Gohan<br 

 <br />Ten Ways to Wear Ladies Polo Shirts and Rugby Shirts<br />
 <a href="http://www.ancienshoche.org/" title="rape porn" > rape porn </a>trends cheaply<br 

 <br />How to Enjoy Fall&#8217;s Bounty of Pumpkins<br />
 <a href="http://www.prgn.com/" title="cartoon porn" > cartoon porn </a>Many of us think that fashion applies just the clothes we wear<br />

 <br />Macerich&#8217;s CEO Discusses Q1 2013 Results<br />
 <a href="http://books.rainbowchild.ro/" title="hd porn" > hd porn </a>A group of models will stand at the entrance<br />

 <br />girl Madeleine McCann possibly sighted with German family in Spain<br />
 <a href="http://assih.com/" title="weight loss tips" > weight loss tips </a>Do not let your shoes wear you<br />

 </div>

The links were not visible on any of the sites, as you can see by the code the div block is positioned out of the viewport.

Here are some of the sites, they all appear totally legit and normal and not part of any backlinking scheme network or something...

www.uppervalleychiropractic.com/2013/12/free-workshop-staying-balanced-healthy-and-sane-during-the-holidays-simple-ways-to-finish-this-year-with-grace-and-ease/

www.msema.org/two-mississippi-counties-declared-federal-disaster-areas/

treeplea.es/aprendiendo-de-los-mejores-managament-en-estado-puro/

www.llamalloyd.se/amnen/english/

I can't figure out what the motive is and why it was done??

  • The backlinks on the (hacked?) WordPress sites are all linking to real companies
  • Why are all the anchor text terms related to porn?
  • If these companies have hired someone to create backlinks for them, why would they insert porn terms in the links and thus ruining their customers SEO?
  • Could it be competitors that have hired someone to create these malicious backlinks in order to damage their SEO?

I'm a bit shocked by this because this single site I was researching had hundreds and hundreds of porn backlinks from hundreds of legit WordPress sites.

How was the hacking done and why?

  • My gut tells me that someone is seeding these things to frustrate the algorithms which search engines use to weed out porn... If porn tags associate with a link to a site that has an otherwise high reputation in the search engine, then either the porn filters are going to block good sites or the porn filters will learn the wrong lesson and ease up their settings. As to how, well, wordpress is easily hacked when not maintained... and it's 97.3% not maintained. – gowenfawr Jul 29 '17 at 13:40
  • 1
    Perhaps something like Bayesian poisoning – CodesInChaos Jul 29 '17 at 17:42
  • In this case it's Bayesian poisoning, but the same technique is used in Google bombing (i.e. instead of "porn," make the top search result for "idiot" return Donald Trump's presidential page). – Ivan Jul 29 '17 at 21:24
1

How was the hacking done?

Wordpress and its plugins have a long history of security vulnerabilities. These vulnerabilities usually get fixed rather quickly through updates, but many people don't update their wordpress installs. The web is full of Wordpress instances some people set up and then forgot about. These are a prime target for black hat hackers who run bots to find these sites, exploit the vulnerabilities and insert the content the hacker wants.

But why associate non-porn websites with pornographic keywords?

We can not read the minds of the hackers or their customers, so this is pure speculation. Possible motives could be:

  • Harm the linked websites by getting search engines to flag them as porn and thus hide them from safe search. They might do that to benefit the competitors of these websites or to blackmail them.
  • As suggested in a comment by CodesInChaos: It could be an attempt at Bayesian poisoning. The spammers want to confuse the porn detection algorithms of search engines and filter software to make them less reliable. The motive could be to get some of their own sites reclassified as safe for work without deassociating them with explicit porn keywords.
  • They might want to exploit some halo-effect in search engine algorithms. They hope the search engine will reason: Popular site is about porn. Spammers site is also about porn. Therefor, any user who likes popular site might also like spammers site.
  • For Science! It's just an experiment. They want to know how search engines will react to this attack to figure out more about their algorithms. The algorithms of search engines are closely guarded secrets and the business of tricking them is a multi-billion dollar industry. The more you know about them, the better you will be at SEO.
0

Sounds very much like someone is performing negative SEO to affect the rankings.

  • 2
    Please do not give one line answers. Explain why this works. Illustrate with (real world) examples or references, if you know (of) any. – Jan Doggen Aug 10 '17 at 18:36
-3

The hacking was probably done through a vulnerability on Wordpress. Wordpress has security vulnerabilities all the time, and if you don't apply any updates it'll quickly become insecure.

Why? PageRank. The hackers embed hidden links in an attempt to boost the search engine score of their illegitimate site. These sites could be scams or distribute malware, but a user seeing it on the first page of Google will visit it without hesitation.

  • 1
    Downvoted because this does not address the question. The embedded links were to legitimate sites, not to porn sites. The attackers were not trying to raise up the links to illegitimate sites, they were instead associating legitimate sites with porn words. – John Deters Aug 1 '17 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.