Threat library

Know the pattern before you start digging

Each profile describes how the compromise works, the signals that confirm it, and what removal actually involves.

A threat profile is written for the moment you already suspect something is wrong and need to identify the pattern. Each one describes how the compromise behaves, the evidence that confirms it rather than merely suggests it, and what removal actually involves — including the persistence that has to go first.

The profiles here concentrate on search-visible website compromise, because that is the category site owners most often meet and most often misdiagnose as an SEO problem. Where a profile overlaps with another, the relationship is stated explicitly instead of repeated: cloaking, for example, is the concealment layer that hides the payloads described in the other profiles.

What this section covers

Behaviour: what the attacker's code does, and which visitors it does it to.
Confirmation: the specific checks that distinguish this pattern from a configuration error.
Removal: dependency order for cleanup, and what causes reinfection.
Search recovery: what to tell Google and when to ask for review.

Key concepts

SEO spam
SEO spam is unauthorised content or links injected into a website so that attackers can rank and monetise pages on someone else's domain.
Cloaking
Cloaking is serving different content to search engine crawlers than to human visitors for the same URL.
Redirect chain
A redirect chain is a sequence of two or more redirects between the URL a visitor requested and the page finally served.
Doorway page
A doorway page is a low-value page created mainly to rank for a query and funnel visitors somewhere else, rather than to serve them itself.
Backdoor
A backdoor is code or configuration left on a system that lets an attacker regain access after the original entry point is closed.

Tools for this section

SEO Spam Scanner
Checks a URL for injected spam content, crawler-only output and foreign-language keyword pages, and explains every finding.
Suspicious Link Scanner
Extracts every outbound link from a page, flags anchors hidden with CSS, and groups destinations by domain so unexpected ones stand out.
Redirect Scanner
Follows the full redirect chain for a URL across desktop, mobile and search-referrer conditions, so conditional redirects surface.

Continue

SEO Spamintermediate
Japanese Keyword Hack
An SEO spam attack that injects Japanese-language pages into a compromised site to hijack search listings. How it works, how to confirm it, and how to clean up.
Updated 28 Aug 2026 · 4 min read
SEO Spamintermediate
Hidden Link Injection
Attackers hide outbound links in your templates and content to pass authority to their own sites. Where the links hide, how to find them, and how to remove them safely.
Updated 20 Aug 2026 · 2 min read
Website Malwareintermediate
Malicious Redirects
Conditional redirects send your mobile or search visitors to scam pages while the site looks normal to you. How they are implemented and how to trace them.
Updated 22 Aug 2026 · 2 min read
SEO Spamadvanced
Cloaking
Cloaking serves different content to search engines than to people. It is the mechanism that keeps most injected spam invisible to site owners.
Updated 14 Aug 2026 · 2 min read

Know the pattern before you start digging

What this section covers

Japanese Keyword Hack

Hidden Link Injection

Malicious Redirects

Cloaking