Massive stats drop - BlackHat Casino SEO?

[Aussie-Dave]

Hi all,

For over 3 years my main Australian facing site "Raw Funk Games" has held numerous spot 1 SERPS in google, in addition to countless top 3 spots. In some of the related search terms, I've held up to a 90% domination on page one with all of my Australian facing sites listed on some Google pages. To top that, Google has given RFG site wide links.

I'm no slouch when it comes to SEO. ;D

Unless you've been living under a rock for the past 18 months or so, you'll know the Australian gaming market is hot property these days. Even with the increase of activity and competition RFG has remained solid with its Google SERPS.

Mid Oct 2010 I started seeing a drop in stats. I didn't really worry about it as I've seen stats go crazy in Oct before. But today I'm over at Google Webmaster Tools and whilst checking out my top keywords, I spot Viagra listed as the 3'rd top keyword, WTF

Closer inspection highlights 723 instances of the "V" word apparently found by Google in 2 pages. The site uses WordPress - One page being a blog (with 5 tag pages) the other a static page.

Checking all these pages thinking I've been hacked, I didn't turn up anything, no "V" in any of the code, tags, meta data & or content. However as far as Google is concerned my site's 3'rd top keyword is the "V" word.

Of course at this point I'm freaking out because now I know why my stats have taken a beating (search term stats in webmaster tools are all red arrows pointing down).

Checking my SERPS tells the story all too clearly. I've taken a hiding on them too. The majority of spot 1 and top 3 SERPS have all but gone west.

With how this industry is going lately, with all the shaving, stealing of affiliate earnings and all the other BS going down, it would not surprise if one of the casinos trying to gain a foothold in the Australian online casino market, has used malicious BlackHat SEO to f#ck my site over.

You can see by the following screen caps that something is amiss here. Right now I've had to change page urls, screw around with 301's & edit page content to have it return updated content to the xml sitemap.

If anyone has any ideas how this could happen, I'd appreciate the input.



Cheers



Dave

 

[Aussie-Dave]

I posted my question over at Google forum and thankfully got a reply.

Some a hole has injected viagra links into the footer of my WP.
xxxhttp://webcache.googleusercontent.com/search?sourceid=navclient-ff&ie=UTF-8&q=cache%3Ahttp%3A%2F%2Fwww.rawfunkgames.net.au%2F

Now I have to clean it all up and try to get Google to reconsider crawling the site again. Thanks to this pr#ck my income has gone south.

If your running WP check you sites against google's cache.


Cheers

Dave

 

[lots0]

Dave,

I've seen this before.

can't talk right now, on my way out the door.
I'll PM you tomorrow.

 

[arkyt]

YIKES ... I have seen a dramatic down turn in stats to my primary site as well - despite having good positions in the SERPS ... I have thought to myself maybe some hacker is stealing my SE traffic some how - but I havent been able to nail the origin down yet.

 

[lots0]

Dave check your backlinks as well.
Besides the malware and adult links they inject on your site.. these guys will use the exploit on other sites to put up search engine unfriendly links pointing toward your site.

Be sure to tell google about this, as they don't always check the back links when checking for malware. I would just ask google for a complete reinclusion check.

Wordpress... IMO bad news... it's a major hacker target with so many holes and backdoors you'll never find them all, not to mention that getting wp to acknowledge and/or fix these exploits in the past have taken forever or not gotten done at all.

And double check for backdoors.. once there in, these guys love to leave backdoors all over the place.

 

[bonustreak]

Thanks for the info so glad we don't use WP!

 

[Aussie-Dave]

Wordpress... IMO bad news... it's a major hacker target with so many holes and backdoors you'll never find them all, not to mention that getting wp to acknowledge and/or fix these exploits in the past have taken forever or not gotten done at all.

And double check for backdoors.. once there in, these guys love to leave backdoors all over the place.

Hi lots0,

Thanks for the info mate, I really appreciate it:emoticon-0137-clapp

Usability and functionality for myself is great in WP. However the biggest PITA are theme updates, these can turn all your hard work into a dogs breakfast IF there are changes to the WP core coding. In addition some plugins...well you know what I means.

Frankly this happening now is a wake up call for me. It proves what I've been thinking for a while now - I've got too many sites and I can't manage then all.

I'm not 23, 33 or even 43 and trying to manage 30+ sites is taxing. I don't want to hire developers and what not, I want to wind things down and concentrate on at most three sites.

If I look at this in a positive way whoever did this, did me favour.


Cheers



Dave

 

[Aussie-Dave]

Thanks for the info so glad we don't use WP!

Yeah but you use vB.
From I've been reading lately that's not much better.


Cheers



Dave

 

[RodgerW]

Hi AussieDave, sorry to hear about your dillema.

What it looks like is that your theme "Mystique" was probably the focus of the exploit the them has a lot of built in logic, perhaps exploitable in early versions, dont have time/inclination to investigate tho.

If I have to be completely honest it does not look like you update other core components that you are using either. (All in One SEO Pack 1.6.10.2 time of exploit in google cache) current version is 1.6.12.2.

The the best advice I could bestow is.. If you are going to use customized opensource systems keep your sites/components updated to the latest versions and keep your themes and components updated and simple.

Every line of added logic, adds to the potential risk. duh!

If wordpress is kept in check it is inherently a stable enough system to operate on the web (ask Matt Cutts). If not.... well..... mmm...

If you are managing vast networks and can't keep tabs on all your installs, find ways to automate routine tasks like wordpress updates.

BH Casino Guys
Not quite sure how reach some of your conclusions/speculations on BHSEO by the casinos the Google cache is all V i a g r a links to exploited .edu domains. I suspect if BHSEO casino guys were to blame the links would target other locations that would aid their cause (given the opportunity). I could be wrong...

IMHO (based on this post facts) it looks like an "own goal" sorry m8. Could have happened to anyone regardless of industry.

I would suggest getting a few of your friends to push a few social media links to your site, to get re-indexed again. Tweets, stumb, e.t.c

Does not look like a serious penalty, if all is fixed and well again Google should show you the love again.

Lesson learned the hard way Im affraid, hope you recover it quickly enough.

Best of luck

Rodger