Injected links to fraudulent domains on the site

What it is

The HTML of your homepage contains links to domains with suffixes that fraud campaigns use in bulk (for example .sbs, .cyou, .cfd). Links you did not put there yourself are the typical fingerprint of SEO injection: an attacker adds a hidden block of links to the page to borrow your domain’s reputation.

We only look at the homepage HTML as an ordinary visitor receives it. This is a heuristic. We cannot tell how the attacker got in or how many other pages are affected.

Why it’s a problem

• Search engines tie you to fraudulent sites and your domain’s reputation drops.
• Your visitors can reach the harmful targets, and a browser or Google may flag the site as dangerous.
• Injected content means someone can change your site’s files or database. The links are usually only what you happened to notice.

How to fix it

Treat it as a possible compromise until proven otherwise.

1. Find the injected code

curl -s https://example.cz/ | grep -oE 'https?://[a-z0-9.-]+\.(sbs|cyou|cfd)[^"<> ]*'

Search for the same domain in the theme, in installed plugins and in the database (posts, widgets, theme options). The hidden block is often concealed with display:none or positioned off screen.

Some injections are shown only to search engine bots. What you do not see in a browser is not necessarily clean. Fetch the page with a bot header:

curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.cz/ | grep -c 'display:none'

On its own the count means little, because legitimate pages also use display:none. Run the same command without the -A option (a normal fetch) and compare: a clearly higher number for the bot header, or hidden blocks with links you do not recognise, is the signal.

2. Find how the attacker got in

• an outdated plugin, theme or CMS core,
• a leaked or weak admin, FTP or hosting password,
• recently changed files that you did not change:

find /var/www -name '*.php' -mtime -14 -type f

3. Clean up and harden

• restore the site from a clean backup, or remove the injected code and any backdoors by hand,
• update the CMS, plugins and themes, and delete the ones you do not use,
• remove unknown admins and change every password (admin, database, FTP, hosting),
• run the scan again afterwards. If Google flagged the site, request a review in Search Console.

References

• Google: spam policies