Although most of my work time is dedicated to promoting my client’s websites and improving their link popularity, I occasionally take on side projects for them such as website redesign or SEO consulting and SEO updates. A few months ago, I converted a client’s website to Web 2.0 by installing Word Press and migrating all of her existing content to it. The change allowed her website to become a Blog so that she could create and edit content from any web browser without the need to learn HTML or any other web authoring language.

A few months later, disaster struck when I found that all of her keywords took a nose dive in the SERPS. After a closer look, i found out that someone had hacked into her server and uploaded or injected code that spawned 2,500 pages of adult nature on her server. When Google crawled her site after these adult pages had been published, it found every single one of them, crawled the links to them and indexed these 2,500 adult pages serving adult videos as if it was part of her real content.

After this happened, the adult content being served through her domain outnumbered the number of pages of legitimate content and apparently changed her website’s composition or “profile” from a legitimate business related website to an adult site serving mature videos and images to her visitors.
As a result, her business related site had now became an adult site in the “eyes” of Google, causing all of her real keyword phrases to no longer be relevant for her site. In other words, before the attack, her site was 100% about “widgets”… after the “porn invasion”, her site was 95% about porn videos and 5% about “widgets”.

Thinking that the Blog I had installed for her was part of the reason why this happened was a serious concern of mine. After all, it had been just a short while back that I installed Word Press on her server. I was sure I had done a clean install and made sure her theme / template files were cleaned up of any un-necessary code but when this happened, I couldn’t help but wonder – was I somehow at fault? Did I accidentally facilitate this through Word Press? Did I miss some malicious code on her theme files? Or, could the problem be somewhere else entirely? If the site or Blog weren’t at fault, could the issue be with her hosting company and their servers? I had to fix this and I had to do it fast but before I could start working on the solution, I first had to find out how it happened.

After a few days of reverse engineering the hack and playing cyber detective with every single file I could see through her hosting account, I was able to:

• Find the company responsible for the attack
• Find thousands of other websites that were also hacked in the same way
• Develop a good understanding of how this happened
• Find the common denominator between all this

1. The company responsible for the attack – is a spammer, black hat marketing company based in California. A little research into their background clearly identified them as someone you’d want to stay away from at all costs. I won’t name names here, as I don’t really want to be next. However, if you’d like further details on this, send me an email.
2. Thousands of others currently infected in an identical way – there are thousands of other websites affected by this and my guess is that most of them don’t even know they’ve been hacked. I found static websites that had been compromised in the same exact way as well as Blogs. Each of them ranged in topic from golf supplies to car dealerships. Sadly, I even found a church’s website being used and exploited to distribute adult material by this same spammer company! I’m pretty sure that neither the golf supply company, the car dealership or the church are aware their websites are being used to distribute adult material right “under their noses”.
3. How does this happen? To promote their adult content online, the spammer marketing company infects thousands of web servers and injects malicious code that will then spawn adult oriented pages and outbound links to the “mother” site. Once this happens, each hacked server becomes another live domain used to distribute their adult material and drive traffic to the “mother” site.
4. The common denominator between all of the hacked sites – I knew I had to find a common link between the exploited sites if I was going to be able to figure out who or what was responsible for this. By doing a WHOIS database search on a sample of the victim sites, I found they all had one thing in common. The common denominator between EVERY single one of these sites and Blogs that had been hacked into by the same spammer company for the same exact purpose was that they are all hosted at Network Solutions. I was glad to find out the attack had nothing to do with her Blog or with her Word Press installation. Obviously, the spammer company has figured out a way to compromise Network Solution’s servers gaining access to thousands of unsuspecting clients that host their legitimate websites and Blogs through them.

Don’t let this happen to you!

If you currently have a site or Blog hosted with Network Solutions, run the other way, fast! If your site hasn’t been hacked, there’s a good chance it could be next. Can you afford to do nothing and wait? Not if you’re a serious online marketer and not if you care about your online presence. Back up your entire site immediately, and change hosts ASAP.

Also, if you are hosting at Network Solutions and have experienced a sudden decrease in ranking position, I’d love to hear from you. Perhaps your own site has been infected and you may not even realize it!

Alternatives and Solutions

I own and operate multiple websites and Blogs so over the years I’ve gotten a good feel for a few hosting companies that I feel are safe, reliable and overall trustworthy. These trusted hosting companies are just a few I feel safe to recommend based on my own personal experiences with them. However, these are just a couple out of hundredths of hosting providers available, so… I’d like your feedback:

• How’s your host treating you these days?
• How’s the level of service you’re getting from them?
• Overall, are you happy with them or will you be saying good bye soon?
• Would you recommend your hosting company to your best friend?

Updated on 11/13/08:

• See Part 2 of this story here.
• Skip Part 2 and see resolution to this problem here.