Google search results hijacked

We have all done that. You open Google and type the keyword you think your website should be ranking for. If you are lucky, the website appears somewhere on the 1st page, and if it does not, you might just as well forget about getting business from search engines. And just sometimes, you will notice something very bizarre, something that really should not be there on the results at all.

Glitch in the Matrix

This happened just very recently (early December 2015) to us at Gametop. Historically we have done quite well in terms of search engine ranking and a fair bit of our traffic can be attributed to Google and other search engines.

It was supposed to be just a regular day checking the rankings, seeing the numbers going up and some going down. However, there was (and still is at the time of writing) a glitch in the Matrix.

A common search phrase for us would be “download free games”. It makes perfect sense, because our website is all about providing free and legal full version games for users to download. Suddenly we noticed a new player on the search results page. Of course the search results are organic, and forever changing, but this looked somehow familiar. Actually the description below is a word for word copy from our description. Okay, these things happen, people copy things that seem to work. Imitation is the sincerest form of flattery and so on.

So, I wanted to check what is this site all about. Clicking the link takes you to a roller coaster of automatic redirects eventually landing on a page with scraped text content and Google ads.

Here is the full list of redirects and final landing page.

  1. www.teamtalkmedia.com/?t=Free-Game-Downloads
  2. www.bebesdress.com/game.php
  3. http://freeonlinegames.top/
  4. http://www.freegame3s.com/download/freegames.html

Obviously there is something wrong here. A screenshot of the final landing page is seen here below. None of the navigation actually works, they just load another page with a different set of ads.

The fake page with scraped content and Google ads

Okay, back to Google then. You see that small green triangle on the right side of the green link? Clicking that and choosing “cached” gives you a snapshot of what Google saw when they visited the page.

Search results from Google

The cached result looks very familiar, and nothing like the page contents you would see if you would click the link. Actually, the content is a direct copy of the Gametop frontpage without most of the images.

Cached page contents from Google

So all this peaked our interest and we had to investigate a bit further. Just by taking the same link (www.teamtalkmedia.com/?t=Free-Game-Downloads) and pasting into browser took me to the “normal” teamtalkmedia.com website.

So, the fake page comes up only if clicking a link from Google, but otherwise a regular page from the domain is served, despite the extra parameters in the URL.

Business as usual? Maybe not.

Okay, copying a site is nothing out of the ordinary these days. It happens all the time, but luckily Google is getting better at spotting the fakes. But there are a few very disturbing facts out in the open here. First of all, the cached content should at least be somewhat similar to the contents of the current page. Secondly, the current page is clearly a scam page parsed together from bits and pieces. There is no real content on the page, the navigation is bogus, the text content is stolen (copied and pulled from elsewhere with 301 http status redirects) and the page is littered with ads served by Google. I don’t know about you, but if I were AirBnb, I would be rather pissed off with having my advertisement shown on a fake site. I think we don’t even need to start talking about if the advertiser should have this kind of “brand exposure”.

The biggest problem lies in the fact that the link to the scam site appears in the search results page. And not just somewhere in the results, the page and link are having the 4th position on the 1st page. Mind you, “download free games” is fairly competitive keyword and companies are willing the pay good money to appear here.

According to Searchmetrics the keyword/phrase is getting about 23000 queries monthly with an average CPC price of €0.57, so the traffic is significant already for just one keyword.

Searchmetrics keyword discovery
Google search results page for: download free games

So what is happening?

Teamtalkmedia website apparently has been hacked. Most likely the webmaster and people at teamtalkmedia have no idea their site is doing this because for other users everything appears normal. Seems that there is an infected javascript loaded from a 3rd party site in their site code. From what I’ve gathered, teamtalkmedia is a real company with offices in London, Leeds, Capetown and Johannesburg. Their business is in covering sports news; football, cricket, golf and so on.

The screen capture below shows clearly when the hackers started doing something with their site. It is important to note, that in the top 10 competitors there are two more sites that are equally hacked. The final landing page after the torrent of redirects is the same for all these three sites: http://www.freegame3s.com/download/freegames.html

The freegame3s.com domain is apparently registered under a company called HICHINA ZHICHENG TECHNOLOGY LTD.

The organic traffic, keywords and positions heatmap show clearly when this started happening. Obviously the website in question should not be ranking for “free game download”, “computer games free”, “download game” etc.

Teamtalkmedia.com analysis from Ahrefs.com

A network of hacked sites

With a little more digging, we found that there are more sites involved in the scam. Probably there are countless more, but it is difficult to find these sites because they are not directly linking but just providing a redirect.

  1. www.phenixa.com/?t=gametop
  2. www.rowingbike.com/?s=games-free-download
  3. www.teamtalkmedia.com/?t=free-kids-games
  4. www.ad-tech.co.nz/?t=download-free-games

By going over to Google and doing a quick search with the parameter site: we can see all the pages from a particular domain that are listed in the index.

For example, in the case of Phenixa.com we get about 5700 pages. And looking at the page titles, about 5695 of them are something else (football jerseys, free games, etc.) than what the site is supposed to be (Moroccan engineering company).

In the case of rowingbike.com there are not so many fake page in the results, but most likely hundreds still. The titles are very revealing of the target:

www.rowingbike.com/?s=gametop

www.rowingbike.com/?s=online-games

www.rowingbike.com/?s=miniclip

www.rowingbike.com/?s=download-games

www.rowingbike.com/?s=Free-Online-Games

Here is another view into rowingbike.com website and their sudden appearance in search results for the term “free games”. No previous ranking history and there it is in position 27.

Keyword position history

Position 27 is not first page, but surely some of those almost 900.000 searchers monthly end up to this site as well.

Monthly search volume

Conclusions

The situation is ongoing and we have not reached any final conclusion, but a few things are already certain.

  • Hijacking the search results page push down sites that should be ranking normally and ultimately costs them business.
  • Advertisers are having their ads shown on sites that are created only to cheat people. The brands end up being associated with a very wrong crowd.
  • Google is losing credibility because of its inability to show results that are relevant to the query of the user. It is a serious matter for Google to have spammy links in their index, let alone promoting such sites and pages on the first page results.
  • Websites that offer quality content, are having their brands tarnished, lose traffic and revenue.

Obviously the first thing is to check if your site has been hacked. Once you have established that everything is in order you start to look for the culprits from elsewhere. The situation is something like driving a car in heavy traffic. It is not enough for you to be careful, because there are so many other drivers whose behaviour (sites) you can’t control. Google would be the police in this case. They try to maintain order, but can’t be everywhere all the time.

As I said, this is a fast moving situation and we are trying to keep on top of it all. I would love to hear your take on this, and if you are experiencing something similar with your site(s). If you are interested, there is part 2 to this story here.

Click on the recommend button and share on Twitter if you feel this was valuable information. You could also add me on Twitter @juhakuvaa