{"id":65,"date":"2019-02-17T07:43:24","date_gmt":"2019-02-17T07:43:24","guid":{"rendered":"https:\/\/explicitly.me\/?p=65"},"modified":"2021-04-28T20:48:26","modified_gmt":"2021-04-28T20:48:26","slug":"what-we-learnt-from-a-pills-link-hacker","status":"publish","type":"post","link":"https:\/\/explicitly.me\/what-we-learnt-from-a-pills-link-hacker\/","title":{"rendered":"What We Learnt From A Pills Link Hacker"},"content":{"rendered":"

This post is a first for me. First time there is a guest post (well semi-guest) on this site. It also is my first collaboration with one of my favourite\u00a0Research SEOs Neyne<\/a>. \u00a0Neyne (Real name\u00a0Branko Rihtman<\/a>) doesn\u2019t blog very often, but when he does it is always worth a read. This is a two part post, the first by Neyne, with the second part by yours truly.<\/p>\n

My last post was about using\u00a0WordPress Plugin Flaws to link build, \u201caka soft hacking\u201d<\/a>. However what we are about to demonstrate is another opensource CMS, Joomla, has just as big a flaw as WP. We didnt investigate the backdoor, or how it was done, however we do demonstrate the extent to which it works.<\/p>\n

Worse Than Blackhat, Meet The Hacker SEO<\/h3>\n

Just like with \u201cSEO is Dead\u201d debate that raises its lame head in seemingly regular intervals over the past few years, so does its not-so-distant cousin, the \u201cWhitehat vs. Blackhat\u201d debate. There has been one raging on the popular blogs in the last week or so and, just like with its useless relative, this round did not bring any new arguments nor has it convinced anyone on the either side of the argument. However, not often does one get to encounter a true black hat campaign, one that leaves you with no doubt as to whether it is useful or not nor whether it is illegal or not. Thanks to a tip from one of my SEO buddies, I have taken the glimpse into the eyes of the beast, and it ain\u2019t pretty.<\/p>\n

Just before we dive in, I want to make something clear. I don\u2019t usually out websites or SEO techniques. I think that outing is a cowardly practice, done by people that are not capable of outperforming others. Or in the immortal words on\u00a0one of Aaron\u2019s tshirts<\/a>: \u201cI have a very high tolerance for spammers, but a very low one for weasels\u201d. That said, the techniques outlined in this article are most probably illegal (not a lawyer, so don\u2019t want to be definite on that one). They include hacking into other people\u2019s sites, flagging them as pill-related, squandering their link equity and eventually getting them flagged as compromised in Google SERPs, thus seriously decreasing their CTRs. Asshatery like that should be eliminated and I feel no remorse for doing so.<\/p>\n

It all started with an enquiry of the mentioned friend\u00a0about one of his client\u2019s sites. The site seemed to be OK, nothing irregular about it; however, when looking at the Google cached version of the site, a footer appeared:<\/p>\n

\n

\"Pills<\/p>\n

Pills Footer<\/p>\n<\/div>\n

This footer does not appear when the site is visited with Googlebot useragent, so my guess is that this is a case of IP cloaking. The more interesting thing is that none of the sites linked in the footer seem to be V1@6r@ related. \u00a0They are regular sites on a wide range of topics. So my first thought was that this is a hatchet job \u2013 a slimy SEO company that is trying to ban their competitors by creating thousands of artificial, spammy links on hacked sites. However, when looking at the source code of Google cache of each of the linked sites, a different picture started to emerge. Check out the differences between the <header> element as it appears on the live site vs. how it appears in Google Cache:<\/p>\n

\n

\"Google<\/p>\n

Google Cache Header of Haked Site<\/p>\n<\/div>\n

So my next question was whether these site rank for any of the linked phrases. Almost all of them did. Check out this SERP for [V1@6r@<\/strong>\u00a0price] (6600 Global Exact Match monthly searches)<\/p>\n

\n

\"\"<\/p>\n

Ranking for V Price<\/p>\n<\/div>\n

So here came a head scratching part. It seems like someone is hacking into Joomla based sites, planting links in their footer to other hacked Joomla sites, whose header is cloaked to show\u00a0V1@6r@-<\/strong>related keywords. But what is the point? Why would someone send\u00a0V1@6r@-<\/strong>relevant traffic to totally unrelated websites? Then I clicked through to the site from the above SERP. This is the site I got:<\/p>\n

\n

\"Now<\/p>\n

Now you See It<\/p>\n<\/div>\n

If you go to the site directly, by typing the URL into the address bar, this is what you get:<\/p>\n

\n

\"Now<\/p>\n

Now You dont<\/p>\n<\/div>\n

So not only are they doing IP cloaking, they are also doing referral cloaking to show all visitors referred from Google SERPs .\u00a0 Here is a partial list of sites, with their original Titles, hacked Titles, keyword they targeted with footer links anchors and their ranking on Google.com for that keyword:<\/p>\n

\n

\"Partial<\/p>\n

Partial List of Hacked Sites<\/p>\n<\/div>\n

There is one thing that is common to all the websites in question \u2013 they have been all created in Joomla. Furthermore, it is easy to target them as there is a clear indication they are Joomla based in their header:<\/p>\n

<meta content=\"Joomla! 1.5 - Open Source Content Management\" \/><\/em><\/pre>\n
***********Investigation Ends*************<\/h3>\n
\n
\"Search<\/p>\n
Search Volumes for v1@6r@<\/p>\n<\/div>\n
So Neyne has shown you the what, how and why. Hacking these many sites for those rankings isn\u2019t an easy job, unless you prebuild in\u00a0hacker doorways as I demonstrated in the WP Plugin Security fail<\/a>. The only other way to do this is to run a number of brute force scripts on known weak spots of various servers and CMS\u2019s. I want to show you what I learnt from investigating those links with Neyne. Like I said with the JC Penney scenario,<\/a>\u00a0when you get a chance to learn, do it.<\/p>\n
10 Things I Learnt About The V1@6r@ Link Hackers<\/h3>\n
1. Old spam tactics still work<\/h4>\n
\"\"<\/p>\n
A while ago, I wrote about\u00a0Spam Tactics, Then and Now<\/a>, where I identified a number of tactics that still work. This discovery reinforces what I learnt back then, that old spam tactics dont die, they just resurface. And that Google isnt really as sophisticated an algo that people believe it to be.\u00a0 Some of the points below take this into more detail\u2026<\/p>\n
2. content is not king<\/h4>\n
None of these sites that we investigated were serving up content that was\u00a0V1@6r@\u00a0<\/strong>related. Of course quite a few had cloaking which meant that some conteant was being shown, but after investigating a number of these sites, not all had redirection or cloaking set up as yet.\u00a0 And as a result just had links that were doctored.\u00a0 So why did they rank for these keywords?<\/p>\n
Just links. Links, links and more links. What about great content? Nope. Links.<\/p>\n
Using Majestic, lets look at what the links could be like:<\/p>\n
\n
\"Look<\/a><\/p>\n
Look at all those links! (click to view Majestic data)<\/p>\n<\/div>\n
3. anchor text over rules all<\/h4>\n
\n
\"Wordle<\/p>\n
Wordle for Links<\/p>\n<\/div>\n
Relevancy, thematic links, semantic analysis etc etc can all go to pot if you are working with a large scale access to link text manipulation system. Doesn\u2019t matter where they are placed, and doesn\u2019t matter where they came from.<\/p>\n
An advanced analysis of the anchors for some of the sites we looked at gave you the wordle above\u00a0 \u2013 you can see how heavy the manipulation is. In raw terms:<\/p>\n
\n
\"Anchor<\/p>\n
Anchor links Count<\/p>\n<\/div>\n
4. footer links work<\/h4>\n
For a while SEOs have been devaluing the relevance of links in footer or common elements \u2013 ummm they seem to work.<\/p>\n
5. sitewide links work<\/h4>\n
Again, we get arguments that the value of sitewide links have been dampened greatly. Not when you are working in volume, as we discovered when we investigated these sites.<\/p>\n
6. referrer cloaking still works<\/h4>\n
I think Neyne demonstrated this pretty well above.<\/p>\n
The fact that referrer cloaking works is evident from the fact that the hacked sites are ranking even though they serve different content to users coming from Google SERPs<\/div>\n
Another spam tactic from the past, still live and well.<\/p>\n
\n
\"Scripting,<\/p>\n
Scripting, its an Art – this one isnt. (this is a tracking script on one of the sites)<\/p>\n<\/div>\n
7. i need to set up alerts<\/h4>\n
What really shocked me is that these site owners still haven\u2019t realized that they rank for these keywords. If you suddenly rank for or get traffic from didgy keyphrases, its time to check WTF is going on. Now in the case of user agent redirection, sometimes analytics will not record those visits. But will most certainly show up for high volume impressions if you are signed in with Google Webmaster Tools.\u00a0 AND they have a malware detection piece on there which is worth looking at once in a while.<\/p>\n
8. i need to monitor catch all accounts<\/h4>\n
Google does try and email those sites that they have flagged up :<\/p>\n
\n
\"Site<\/p>\n
Site Compromised<\/p>\n<\/div>\n
\n
\"Site<\/p>\n
Site Compromised on All Accounts<\/p>\n<\/div>\n
But you need to monitor and even set up catch all email accounts: You can find out if your site has been identified as a site that may host or distribute malicious software (one type of \u201cbadware\u201d) by checking the Dashboard in Webmaster Tools. (Note: you need to verify site ownership to see this information.) We also send notices to webmasters of affected sites at the following email addresses for the site:<\/p><\/blockquote>\n