What do you do when you receive an email from Google with the subject line “Removal from Google’s Index”? Yesterday, a web design company in Charlotte which we work closely with forwarded me the email their client had received and asked if it was legitimate.
- – - – - -
The email stated:
Dear site owner or webmaster of [domain name removed],http://www.google.com/support/webmasters/bin/answer.py?answer=35769&hl=en. This appears to be because your site has been modified by a third party. Typically, the offending party gains access to an insecure directory that has open permissions. Many times, they will upload files or modify existing ones, which then show up as spam in our index.http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html. When such changes have been made, please visit https://www.google.com/webmasters/tools/reconsideration?hl=en to learn more and submit your site for reconsideration.https://www.google.com/webmasters/tools/siteoverview?hl=en and going to the Message Center.
While we were indexing your webpages, we detected that some of your pages were using techniques that are outside our quality guidelines, which can be found here:
The following is some example hidden text we found at [domain name removed]:
[domain name removed - it was a link to the current #1 ranked site in Google for the search "download movies"]
In order to preserve the quality of our search engine, pages from [domain name removed] are scheduled to be removed temporarily from our search results for at least 30 days.
We would prefer to keep your pages in Google’s index. If you wish to be reconsidered, please correct or remove all pages (may not be limited to the examples provided) that are outside our quality guidelines. One potential remedy is to contact your web host technical support for assistance. For more information about security for webmasters, see http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html. When such changes have been made, please visit https://www.google.com/webmasters/tools/reconsideration?hl=en to learn more and submit your site for reconsideration.
Sincerely, Google Search Quality Team
Note: if you have an account in Google’s Webmaster Tools, you can verify the authenticity of this message by logging into https://www.google.com/webmasters/tools/siteoverview?hl=en and going to the Message Center.
- – - – - –
Our curiosity up, we began to investigate. It didn’t take long to discover the code on every page of our partner’s client’s site: <img src=”/Portals/3/images/logo.gif” alt=”" /><a style=”top:-7684px;position:absolute;” href=”[domain name removed]“>online movies download</a>
Someone (possibly an SEO company hired by the movie download site) had hacked into the DNN site and secretly added a hidden link. You’ll notice that -7684px in the html code above places the link outside of a computer monitor so no human can see it but a search engine bot can.
The website stealing link juice from our partner’s client ranks strongly for many high volume searches including “download movies” (#1), “”full dvd download” (#4), “full movie download” (#1), and many more. We found a post on a forum wondering how the site in question was able to rank so strongly for high traffic terms within a year of it being purchased. Our curiosity was burning by now.
Examining Google’s reported backlinks to the site (keeping in mind that Google won’t reveal all the backlinks) and knowing that our partner’s client’s site was DNN (dot net nuke), we noticed the high number of DNN sites providing links back to the movie download site. Upon examination of around 8 different DNN sites that we looked at, each one had similar hidden links back to the download movie site. One of the sites had three hidden links to different sites (including the movie download site) which leads us to wonder if the movie download company had hired a black hat SEO company to do their dirty work (known or unknown to the movie download company) and the SEO company was promoting multiple clients simultaneously through their SEO hacking; or, the parent company which owns the movie download site might just use that SEO hacking tactic to promote all of their sites.
It’s difficult to estimate how effective their scheme is. Ranking so strongly for such high trafficked terms could easily translate into millions of dollars per week. Assuming that the entire movie download program is dealing with copyright violation, that turns into a majorly profitable program and the company apparently cares less about what it takes to generate that profit. Of course, if they’re hiring a black hat SEO company to propel them to the top, there is a chance the movie download company is “innocent” but with the kind of business they are in, I wouldn’t be surprised if they were fully in the know about what is taking place. Not to stereotype the web, but the movie download company is based out of Russia (or thereabouts) and they wouldn’t be the first Russian website to deal in questionable activity (in terms of copyright violation, hacking & black hat SEO).
A significant part of SEO is creatively developing valuable links (preferably natural links) back to a website. Such links count as “votes,” and links from topically relevant websites which have many links pointing in to them are considered most valuable. While some SEO companies annoy everyone by mass emailing “requests to link back to me,” these emails are usually flagged as spam and deleted (while giving other SEO companies a bad name). Those mass emails typically result in few if any links back to a client’s site which is part of the reason why companies hire “legitimate” SEO firms to creatively scheme up ways to lure natural links back to a client’s site.
However, in this particular case, we have a suspected SEO company taking link development one step further. Instead of merely purchasing links on high page rank sites (and the movie download site has many of these links helping strengthen it – just view some of the in bound links reported in Yahoo Site Explorer), the SEO working for them decided to implement a wild and crazy scheme to hack into dotnetnuke sites all over the world and secretly place hidden links pointing back to the download movie website. It’s obviously difficult (and close to impossible) generating valuable links through the mass emails (though many spam SEO companies still do it), but this is the last straw. It’s worked, though, and that may be all that they care about. I’m sure the download movie website has made a fortune for as long as these links have been effectively pushing it to the top.
So, what will Google do? I guess that question depends on whether the email to our partner’s client was generated automatically by email (ie their search engine bots were patrolling the web and stumbled across the hidden link on the client’s site) or if a human reviewer from Matt Cutts spam team has been brought on the scene yet. If the latter is true, I would suspect we’ll see some major changes to the movie download site’s organic ranking in Google in the next few weeks.
And what should you do if your website is powered by DNN (dot net nuke)? Ask your website designer to carefully go through the code on your homepage and look for the url of the download movie website or any other suspicious, hidden urls that should not be there. We found that the best way was to view the source (you can do this from any browser – in Internet Explorer, just click on View and then Source) and then, when the source code for that page pops up, click Edit and then Find. Type in the movie download website’s url (click on the Google or Yahoo links to see the domain name of the site in question) and see if they’ve snuck any code on your site too.
For those interested, the web designer mentioned above began a post on the dotnetnuke forums.
Update 03/04/2009: Looks like some filtration may be taking place now as the suspect site is no longer ranking well for the top trafficked searches. Way to go Google! The site is still ranking in the top 3 on Yahoo & MSN Live.
Off the Wall & Unrelated: Don’t forget to check out our revamped SEO friendly web design division: Sozo Creative!
{ 1 comment… read it below or add one }
That is really good lesson for everybody.