4

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list of inbound links in order to do some analysis and found some odd things going on.

There were a number of sites that had never linked to us before that that were now linking to us with anchor text of an explicit nature (asian sex was one of the tamer ones, but they got pretty raunchy) that are clearly intended to attract people looking for porn. Just to clarify - our site has nothing to do with content like this.

The site that contained the links was http://boardroomng.com/. When I go to this site now and look at the source there is nothing pointing to my site. I looked through the source code and found most of the explicit anchor text that I saw in Google WebMaster stuffed into the end of the page, but now it links to a different URL (http://ambiyaan.com which I am afraid to visit).

Could this be an indication that my site is being used for something evil? What would be the end goal of someone doing this? Are there any steps that I should take to make sure that I am protected against whatever this is attempting to do?

  • Hard to know specifically, but one common technique when a site is hacked (as yours or ambiyaan.com may be) is for code to be injected that shows different content to google's crawlers than what is shown to regular, browser visitors. – David John Smith Apr 14 '15 at 23:43
  • 1
    @DavidJohnSmith - do you really think my site may have been compromised if there isn't anything out of sorts showing in the content? It's just boardroomng.com site that has the weird content. – Abe Miessler Apr 14 '15 at 23:45
  • I really can't say for certain, but if you are suddenly seeing a lot of inbound links for something unrelated to your site's content, it may suggest that you have unwillingly become part of a link farm – David John Smith Apr 14 '15 at 23:50
  • Did you buy any SEO packages lately? Black hat SEO tactics, often transparent to the buyer, includes inserting backlinks on other sites with high PR, and can include the abovementioned. – George Apr 15 '15 at 1:56
  • @AbeMiessler How exactly do the links look like? Links to your main website (example.com)? Or links to subpages (example.com/some-page)? And if it's the second, are they links to serious, existing pages? Or are the links to porn? And if it's the last, do those pages actually exist (maybe only accessible under certain circumstances?)? My guess would be that someone want's to hurt your google ranking, but I could also imagine that someone hacked your website and distributes porn with it. – tim Apr 15 '15 at 12:18
1

I think the most likely thing here is that the links are being edited with JavaScript on page load. Google's spiders do not run JavaScript, as far as I know, and it's very common for hackers to use client-side scripts to inject links instead of editing the HTML as it allows for obfuscation and mutation (to prevent users from wgetting and removing the offending code). It's also possible that they are using JavaScript because the site has a XSS bug of some kind.

Either way, they probably point the pre-edited links to you as a misdirection tactic, similar to how virus authors add known DoD IPs to the list of update servers (I'm not sure how common that is but there was another question on stackoverflow regarding a virus that did exactly that).

As for solutions, I'd suggest you convert your website to a porn site and enjoy the free traffic.

  • 1
    Nice solution. All Problems solved ;) – Tokk Apr 23 '15 at 12:52
  • Just a note, Googlebot does spider both JavaScript and CSS. – Bacon Brad Jul 2 '15 at 21:28
0

Seems like a classic case of referral spam.

The idea is not not spam your users. But to spam you or trick you into visiting the site within the referral.

They have likely never visited your site or even know of it. In the case of Google Analytics when you visit a site the GA script sends specific info back. It is very easy to find out what needs to be sent back via dev tools. As a result spammers have created scripts and send the necessary data and spoof their referral to generated property IDs. This is usually why when you visit the referral your site is not listed at all.

Stopping this spam is very hard and unfortunately not real effective. Since they likely never visited your site in the first place prevention on a site/server level is moot. You will need to go into the GA dashboard and filter out referral domains manually.

The good news. If this is the case and you don't care about the referral spam you don't need to take any action as your users and reputation are not at risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.