Hacker and/or Black Hatter

[Perc]

I've recently seen some interesting websites showing up in the search results on google.ca. I first noticed them because of the domain names, and found that most of them were the exact same website, all ranking on the first couple pages for keywords like "online casinos" and "online casinos canada".

All the sites are exacltly the same as this one (the url is included in the footer of all the other websites so it was easy to find):
best-canada-casinos.com

Here are some of the domains with the exact same website that are ranking well:
www.beaverlodgevictimservices.ca
dalsailing.ca
motherbynature.ca
Ontario Environment Network - www.oen.ca

If you look at the preview images in google, it shows all of those websites have recently been changed to the casino portal (copied and pasted exactly), because at the time the preview image was taken, those websites were about what the domain said they were about.

They had this website (based on this google search result), but it looks like the owners got it back:
Online Casino | Best Online Canadian Casino Reviews
www.communityofchrist.ca
Discover how we rate and review Canadian online casino sites so players always get the best deals.

At first I thought those were just old domains that someone bought and changed to casino portals, but seeing that communityofchrist.ca search result and finding the website actually being about Christ, made me think it was probably hacked and recently recovered.

Slightly different but obviously the same person, targeting USA: online-casino-rws.com

I'm sure Google will deal them soon, but I wanted to report this to everyone here.

 

[Perc]

Minutes after I posted this here and the GPWA, those websites are back to normal and my evidence is gone, other than the fact that they are still in the search results with the casino portal titles and descriptions.

 

[Perc]

Here is a picture of the search results.



satellitedishcanada.com is also back to being about satellite dishes, but it wasn't the exact same casino portal as the others in my first post so I didn't include it.

laurier100.ca is supposed to be about a university, but it has a virus on it so I didn't actually make it in to see the site.

 

[Guard Dog]

Wow. I'll bet they are all sites run off the same platform (like an older version of Wordpress, Drupal, Joomla, or other). Still, how do they end up ranking so high in this tough market???

 

[Perc]

Not sure, but they've kicked my site off the first page for that keyword, and are out-ranking my site for other good ones too.

They were all the same single page site (which is still best-canada-casinos.com), except for satellitedishcanada which had the same layout but different images.

Satellitedishcanada and laurier100 rank #1 and #2 for 'online casinos' on google.ca.

 

[Perc]

So I was doing some more thinking, trying to figure out exactly what was going on, and why it would get fixed right after I posted about it. It's not fixed, it just doesn't happen when going directly to the websites.

Going directly to the websites I listed will take me to the regular website, but when I click on them from google, it goes to that best-canada-casinos.com.

Clicking on any other link from google takes me to the site that it's supposed to.

The top result, www.satellitedishcanada.com, re-directs me to www.satellitedisncanada.com where the 'h' has been changed to an 'n' to make it look similar.

It's somehow re-directing me, but only when I click from Google, and only those sites that look like they don't belong on the first page (based on the domain names).

Can someone please try this Google.ca search result link and see if you are getting the same thing?

I tried it on a couple computers and my laptop, both IE and Firefox.

Edited to add: If you're getting to the proper websites from google, try again using Private browsing.

 

[Perc]

Sorry for the multiple posts, but I've figured it out after some testing.

I tried this in Google and Bing.

Do a search for Satellite Dish Canada, click on www.satellitedishcanada.com, it will take you to the proper site.

Do a search for Satellite Dish Canada Casino, click on www.satellitedishcanada.com, it will take you to a casino portal.

The triggers for the re-directs are search engine traffic with the word 'casino' or 'casinos' in the search.

Now, is this a hacker or the site owners using black hat seo? The fact that the several (seemingly unrelated) sites I listed in the first post re-direct to the same casino portal, makes me think the sites have been hacked... but satellitedishcanada.com is different, it has the casino portal title and description on the proper site while the others don't, and the casino portal has different affy tags on the links.

Either way, these websites should not be dominating the first page for these keywords/phrases. If these sites are hacked, the owners may not even know since they are only losing search traffic with the word casino in it. Very sneaky and underhanded.

 

[ocportal]

Good point Perc, unfortunately there are much more such sites. It looks like some super advanced redirection and server preferences tricks, to achieve those top rankings. Any chance an insider at G could have leaked super important algorithm factors to these black hat guys?

 

[pinkytoe]

Similar result on Google.co.uk

Here explains it. How Does the Casino Bonus Spam Work? | Irishwonder's Black Hat SEO Blog

 

[Ukjeff]

Yes this blackhat hack thing is happening a bit lately i have also noticed this in search results. You can send the page to G from the feedback link with your comments - not sure if they look at the feedback who knows.

Try doing a G search for “online pokie” then click the result names from the mentioned below.
cit.nsw.edu.au/
dm-productions.com/
crankandchrome.com
and the next page has several more hacks all from the same site

Wonder if the aff programs he uses know about this or want to be linked to this type of behavior? jackpotcity.com / spinpalace.com / winner.com / betway.com / platinumplay.com