2

Noticed a severe drop in organic rankings and traffic, after investigating what might have been the cause we have found 3 websites that have duplicated the site within their domains. When you click on the duplicated pages on these domains, they 302 redirect to Amazon.

We believe these sites may have been hacked, (or are purposefully doing this) as there are also other websites being duplicated within the domains, all the duplicated sites are in the same niche, t-shirt printing, and the Amazon store they are 302 redirecting too sells T-shirts.

When doing a search for the company name of the main site, two of these sites appear above the main website, in position 1 and 3.

When checking Google's cache of the main site, the website that Google is saying the cache is for the hacked sites, not the main site.

The website is on a hosted CMS and the company is adamant that neither their CMS or their hosting has been compromised, nor is the site.

It looks like some kind of 302 proxy hack as outlined here: http://www.seofaststart.com/google-proxy-hacking/ but if its simply that, how is Google seeing the main sites as the hacked sites when caching it?

I have crawled the site with the user agent set to Google-bot, and there doesn't seem to be any cloaked redirects, canonical tags, external links or other wise.

Improve this question
1
  • I have notice hackers hiding in other web sites. They have found away to design a program that gets added to elements in the site which people really don't know and can't see. When you change your Google account, don't sync anything from your old account, even if it's pictures, just transfer your code and files to a blank drive, and then protect your devices.
    – M Harris
    Apr 6, 2017 at 1:53

2 Answers 2

Reset to default
2

This may be a sneaky blackhat trick I've seen before, see if the below sounds like it could be it.

  1. They take a copy of your website HTML/images etc and store in a subfolder of a domain. Software such as WinHTTrack may have been used for this.

  2. They create and submit a sitemap of this static content to Google Webmaster Tools under their domain and wait a few days for the content to be indexed.

  3. They remove the copy of your website from their subfolder and replace it with an .htaccess file specifying 301 or 302 redirects of all requested inbound to that folder to a strategic URL of their choice.

  4. The result is a ton of indexed pages for your content pointing to their domain which when clicked on, directs them to a competitor of yours. These indexed entries get higher up in Google due to genuine page-rank because of the amount of traffic they steal using this method, there may be many websites they've done this to in the past under that domain name, or subdomains or subfolders of that domain.

Your best bet to try and regain your organic high placement in Google might be to:

  1. report a DMCA infringement via the Chilling Effects website. Even if you're not based in the U.S., Google will:

(a) investigate your claim and should find your content in their archives dating back much further than this naughty domain;

(b) remove the entries from their index for the naughty domain that appear to benefit from this exploit tactic;

(c) add a note to the bottom of their Google Search pages when related terms are entered to inform users that entries have been removed due to copyright infringment.

  1. report the naughty domain name to the relevant registrar as an abusive registration, providing evidence to the behaviour, ideally with dates and times of your discovering it.

  2. report the naughty domain name to their hosting provider providing evidence of current copyright infringment where possible and any evidence to explain and show this strategy of stealing search engine position and clicks for a competitor using your content.

Improve this answer
7
  • Thanks Rich, I have already submitted a DMCA for all three sites, scrapper report and malware reports to Google. They are dynamically copying the site, as we changed some thing and it shows up in the cache on these hacked site after. The big question though is why is Google seeing the cache of our site as if its the hacked sites? I dont see how this could happen unless our site is compromosed, but we been assured it is not.
    – Max
    Jun 24, 2015 at 2:16
  • After factoring removing/ignoring links they have acknowledged are infringing copyright, when Google finds duplicate content it slightly penalizes all sites with it rather than giving preference to any individual site. However if they are getting a higher page rank than you anyway due to the number of visits their site is getting then it will still be listed above yours based on that. It's worth checking your organic SEO is up to scratch to compete as fiercely as possible on those grounds. It is very possible for them to use an exploit script to do all this automatically.
    – richhallstoke
    Jun 24, 2015 at 9:41
  • They can copy your client-side website source code without your website being compromised, they're just taking a copy of what people's web browsers would be downloading before they render the page for you to see (your browser should have a right-click option to let you see the Page Source). If you can identify the source IP/host or other identifiable criteria of the naughty website running this exploit script from information in your web-server logs then you could use htaccess rules (or equivalent if using an alternative to Apache) to block their access to your website content.
    – richhallstoke
    Jun 24, 2015 at 9:47
  • Thanks Rich, yeah I know they can simply copy the site without hacking it, but how is Google seeing the cached version of our site, as if its the hacked site? That's the biggie! This seems to have been resolved now, the cache for our site is actually displaying our site. I pestered Google and think I managed to get a manual review. Rankings are coming back now. Still would love to know how Google could show the wrong cache, hope I get a answer on fthis from them.
    – Max
    Jun 25, 2015 at 3:05
  • Do you mean under listings for your website it was showing the hacker's cached content with their links in? Or do you mean the hacker's cached content was showing under the hacker's website domain above yours in the Google Search results? I'd love to have seen a screenshot of this to help demonstrate, even if you redact the name/domain of your site and replace with generic substitutes like example.com
    – richhallstoke
    Jun 25, 2015 at 8:40
2

Problem explained:-

This hack is getting very common these days. This is surely a glitch on part of Google which is being implemented with the help of hacked websites.

Duplicate websites which are being shown in Google are hacked websites. They are being used as an intermediary to redirect traffic on other websites(or amazon affiliate links in the same niche). These websites may be owned by hacker trying to get traffic on their websites.

Solution:-

All you can do is contact the owner of duplicate/hacked website and asking him to remove the malware from his website ASAP. Once he fixes the website, You will get back your rankings within 1-2 days surely.

I suggest you not to file DMCA complaint against the domain as he is the victim of this hack as well. It's just that he might be unaware that his website contains malware.

Source:-

I also faced the exact problem with my website.

All my rankings were gone, traffic was down to zero and some fake URL was being displayed in Google which was being redirected to some other website (in same niche) if we visit from clicking on Google. That fake website was opening fine when viewed normally. Also if we visit it as "Googlebot" then it was showing exact copy of my website with all content same.

I hope it helps.

Thanks

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.