Japanese SEO Spam: Injected Pages and Search Results Taken Over

A Google search for your own domain returns thousands of pages with Japanese titles, offers of bags and watches at bargain prices, pages nobody ever created. This is Japanese SEO spam, one of the most widespread infections on WordPress sites, and one of the cases where the damage continues even after the cleanup, until the search results return to normal.

How it works

The goal is not to hit the site’s visitors, but to exploit its reputation with search engines. The malware generates spam pages on the fly at addresses that don’t exist on the site, often with a recognizable structure of random numbers and words, and links them to each other and to other infected sites. Google indexes them under the compromised site’s domain and shows them in results, from which visitors are then redirected to counterfeit goods stores.

The pages don’t exist as files: a PHP script produces them on every request, often with content downloaded from an external server. To stay hidden, the script shows the spam only to search engine crawlers, recognized by user agent or IP address, and the normal site to everyone else. It is a form of cloaking.

How to spot it

The most common signs are:

• a site:esempio.it search on Google that shows pages in languages or on topics unrelated to the site;
• a sudden increase in indexed or discovered pages in Google Search Console’s Pages report;
• new sitemaps submitted in Search Console by someone who isn’t part of the team;
• an unknown owner in Search Console’s settings.

That last point is important: a typical step of the attack is to verify oneself as the site’s owner in Search Console, by uploading a verification file to the root folder, in order to submit their own sitemaps and speed up the indexing of the spam.

Seeing what Google sees

Since the spam is shown only to crawlers, visiting the site from a browser is useless. A first check is done with a crawler user agent:

curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" \
  https://www.esempio.it/ | grep -i -c '<a '

But many scripts also verify that the IP address really belongs to Google. The most reliable tool is Search Console’s URL Inspection, which shows the page as Googlebot actually received it.

The cleanup

The technical removal covers the script that generates the pages, usually accompanied by one or more backdoors, the rewrite rules added to .htaccess to route the spam URLs to the script and, often, changes to the main index.php. Then there is the Search Console part:

1. remove unauthorized owners and their verification files, otherwise they can add themselves back;
2. delete the sitemaps submitted by the attack;
3. check that the spam URLs respond with a 404 or 410 error, so that Google gradually drops them from the index;
4. for the most visible pages, use the Removals tool to temporarily hide them in results;
5. if Search Console reports security issues, request a review only after completing the cleanup.

The complete disappearance of the spam from results takes time, because it depends on when Google comes back to visit each individual URL. In the meantime it is essential that no spam page starts responding again: a reinfection undoes the work done. That is why cleaning the files must always be accompanied by a search for persistence, in the database and in the server’s cron.