How Spammers Hijack Abandoned URLs to Spread SEO Garbage Across the Internet

Illustration: Jim Cooke/Gizmodo

“Was The Morningside Post website hacked?” a friend asked me. The site, which I once co-edited, seemed to have died, and returned as a zombie version of itself. About five months ago, my successors at TMP—the student-run news publication at Columbia University’s School of International and Public Affairs—accidentally allowed their site’s web domain registration to lapse. A mysterious new owner snapped the site up, cloned its content, and transformed it all into sloppy, spammy garbage.

Today, there’s a new visual theme and a new, generic tagline, “World News.” References to Columbia University are gone. The old posts are there, in violation of TMP’s copyright, but, they’re no longer formatted, just ugly walls of texts. Author bylines now read “Morningside,” and later “Writer.” Comments sections are closed, the old comments are deleted.

The Morningside Post’s site, before (left) and after the conversion (right).

As of early June, there was just one new post, an advertorial promoting a Toronto-based drone photography company, SkySnap. It includes a prominent link to a strikingly similar article on the company’s site.

In an effort to get to the bottom of what had happened to my old site, I came to realize this wasn’t a one off. The internet is packed with nondescript, cookie-cutter garbage sites: endless badly-written WordPress blogs on marketing and weight loss, keyword-splattered business directories, link-spammed content sections, and fake crowds of braying social media bots.

Why? In large part, because “black hat” and “grey hat” search engine optimizers (SEOs)—those who knowingly violate Google’s rules—create vast networks of interlinked spam content sites, in part on the ruins of the old, Web 1.0 Internet, for the sake of boosting their clients’ own sites to the top of Google’s search rankings. (A spokesperson for Google requested detailed questions, then declined to comment for this story.)

Buying up dead domains for SEO is not a new technique. In the words of Jason Duke, industry veteran and co-founder of the.domain.name, an SEO data site, “Bringing a site back to life, taking the power of its links, that’s been around for 15-16 years.”

The Morningside Post’s new visual theme. “Before” on the left; “after” on the right.

After repeated requests for comment, Slava Gravets, CEO of SkySnap (and partner at AdWave, an SEO and web marketing firm) told Gizmodo, “It definitely looks like a link, like a bought link. We do a lot of link building. We sponsor posts on external websites… It’s very possible we bought the link as part of a batch.” He suggested that a blogger—who SkySnap hired to boost its Google ranking—may have just purchased the TMP domain through a for-hire exchange such as Fiverr. He claimed that SkySnap had no way of knowing the specific sources of all its incoming links and had no control over the website hijacked to link back to their services.

While it’s unclear who bought The Morningside Post’s site (TMP has since resumed publishing, now on a different site), the new owner’s reason for doing so was straightforward, Duke and Gravets both said. It’s all about generating backlinks that boost the company’s Google rank. Incoming links, also called backlinks, are links posted on other sites pointing to your site. Google’s founders Larry Page and Sergey Brin built their pioneering search algorithm on the insight that backlink networks signal important information about sites’ relative “quality ranks.”

TMP’s site has backlinks from sites associated with Columbia University, Harvard University, the Atlantic, Business Insider, Al Jazeera, the Huffington Post and others, according to Moz.com, an SEO data portal. Those links confer status. They tell Google that TMP’s site should be ranked above a similar but lower-status site that covers the same subjects.

“If CNN links to another website, if any publication does, in Google’s minds, that’s a vote of confidence,” said Barry Schwartz, news editor of Search Engine Land, an SEO and search engine marketing (SEM) news site. “That website should rank higher.”

Having that status means new links posted to TMP’s site confer status too, if substantially less than links posted to, say, Harvard’s site, or the Atlantic’s, or Gizmodo’s. That’s what makes TMP’s site valuable to SEOs, and that’s how their Google page ranking improves.

“You’re page one, or you’re nothing,” said Duke. “That’s the reality of making money on Google.”

“You’re page one, or you’re nothing. That’s the reality of making money on Google.”

SEO is a very lucrative hustle for people who know how to do it well: Businesses in the U.S. spent an estimated $65 billion on SEO services in 2016, according to Borrell Associates, a web marketing data firm.

“Google is the new Yellow Pages,” said Duke. “You know how you have ‘AAAA Doorlock Removals?’ This is the same thing, except instead of lots of lots of A’s, it’s lots of links.”

“Links” is a broad term, though. The nuances of Google’s algorithm, and those of its competitors, remain fundamentally mysterious to outsiders. To find out how this works, I talked to Kyle Duck, an SEO consultant and founder of Triumph.ai, who has been optimizing an army of websites to produce backlinks. He claims he used to pull $10,000 a month only from acting as a middleman in link rental transactions.

Duck said that with the rise of artificial intelligence and deep learning techniques, even the companies themselves may not fully know how this works.

In its Webmaster Guidelines, Google instructs would-be web publishers to focus on creating high-quality content and rationally-organized sites, and to avoid techniques that game the system. The company warns against “link schemes,” such as link selling, “excessive” link exchanging, and automated link creation, as well as tactics like hiding invisible text, presenting false-front sites to search engines, and creating sites that trick users into installing malware or viruses that steal information or exploit their systems. An excerpt:


Date:

by