Note: I’m not sure if this is a new exploit or not, WordPress security was made aware of my findings before this post.

Late yesterday afternoon I got a tweet from David Higgens that Penguin 2.0 had rolled out.

I had a been in a dinner meeting pitching one of my side projects, but I got home as quickly as I could to see what the new SERPs looked like. One of my favorite SERPs to watch in the last year or so has been the keyword ‘Payday Loans.’ As my research progressed into the night on this keyword set, I noticed one website that shouldn’t have been ranking at all, but was ranking in nearly every geographic locale I tested for ‘payday loans.’  I tweeted about it in frustration.

My friend and colleague, Steve Hammer, was quick to point out that one of the websites linking to them was a band that was hacked.
https://twitter.com/armondhammer/status/337599812776128512

A quick Google site search and view of the source code proved this to be true. The code for the hack uses the style tag to hide the link within the website’s design scheme so it’s not visually detectable. This made explaining the hacking situation a little more difficult when I contacted the band.

google site search reveals payday loan terms

The band’s website has payday loan terms appearing in a Google search.

hacked code inserted into fishbone.net

the code from fishbone.net

Steve used Majestic SEO to find the hacked website. I went there first to start looking at the data. Majestic showed over 10,000 linking root domains, and all seemingly in the last two weeks. That’s a lot for a payday loan website. I wanted to dig deeper, but I couldn’t create a report, as I’m not on a higher subscription plan or the domain owner. Still the data from Majestic had me curious as to what I would find.

majestic seo chart for the domain

This chart shows the massive link volume in just the past few weeks, and it really ramping up just days ago.

Based on Rand Fishkin’s tweet, I decided to use Open Site Explorer’s new ‘Just Discovered’ tab to investigate further.
https://twitter.com/randfish/status/337597356105162752

At first glance, Open Site Explorer (OSE) showed no metrics, no Domain Authority, etc.. so I wasn’t too positive about the data I would get on the Just Discovered links tab. I was surprised to find over 5,000 links. This is nowhere near the 634,000 links that Majestic stated they have, but it should be a good enough sample size to find out how this website is ranking.

Open Site Explorer shows no metrics, but has links

Don’t be surprised if OSE shows no metrics, but has tons of links to show.

I spot checked a few pages listed such as a car dealer in Kansas, a marketing firm in Houston, and a culinary website in Atlanta, and they all had the same code inserted in them with the link to the domain in question. They also all were disguised to hide on the page. Most of the websites in the list have the exact match ‘payday loans’ anchor text.

It was obvious that a pretty big hacking had occurred, but I wasn’t sure just how big. After exporting the data, I asked my co-worker Andrey Zavyalov, our resident Excel Ninja, to filter out the duplicate domains in the spreadsheet to see just how many websites had been compromised to link to this website. Out of the more than 5,000 links he found, 884 unique domains had been compromised. What is more shocking is that all of them appear to be on WordPress. That’s 884 unique domains out of more than 5,000 links.

Majestic SEO counted 10,000 linking root domains, which could mean if this website’s Modus Operandi is to hack for links (and that’s very likely), then there is a high probability that there are 10,000 websites out there hacked and providing link juice to this website (and probably a different one in the near future). I am not certain if this hack occurred on the newest version of WordPress, however, some of the websites checked had the Meta Generator tag that showed the latest WordPress version of 3.5.1, which is a good indicator to me that this is a new exploit. Hopefully, WordPress gets it plugged up soon.

Side Note: We’ve checked our clients WordPress websites and have not found evidence of hacking, so you’re all good.

Sadly, this is a story that will play out time and time again:  Opportunistic individuals in a vertical abusing and hacking other websites for immediate rankings with a throw away website. Matt Cutts announced in a video a few days ago that some verticals like payday loans would end up getting some special treatment from Google, which hopefully will lead to future solutions for these kinds of issues.

Here is an alphabetized list of the 884 domains that we found to be compromised. I’ll probably take this list down in time, but I wanted to provide it in case your website was hacked or you know someone who was affected. Please help me get the word out to them to remove the injected code on their site. Note: we do not endorse or condone any of the content on the following websites. Visit them at your own risk.

1stchoiceplumbingsd.com 1treehill.info 365cambridge.com
365-kw.com 3fortheroad.com 3guys1movie.com
5stylehigh.com aboundingwisdom.com above180.com abrindoobico.com
accustomedchaos.com addymeira.net afinewshq.com
africanbites.com afwny.com agentmedia.co.uk
agilemaniac.com agilephp.net agrandmotherspeaksout.com
aidforsinglemothers.org a-inhibitor.com airgraphics.com
akntiendz.com aktinhibitor.com aladata.co.uk
aleasylum.com alejandrotarre.com alexandrafigueredo.com
alk-inhibitors.com allechdopor.com allthingsgraceful.com
alohapolitics.com amandameganmiller.net amazingfitnesstips.com
ambitiouskitchen.com amenstreet.com ampedsounds.com
ampirebeats.com androidapplication.mobi androidgamesdownload.org
aneveu.com angryanimebitches.com annabarnettonline.com
annadobrenskiblog.com annieandthebeekeepers.com apologetics.servantsofgrace.org
appletiniphotography.com apuestas-casino-poker.com arninglawns.com
art.links2click.com article6blog.com asiagreenbuildings.com
athenapelton.com atlantaptpi.com atlasstrategies.com
austinteenbookfestival.com authenticmanwithin.com azbex.com
azweatherchick.com babysocial.com.au badgenie.com
bakerbynature.com balljunkie.com baltimoreguide.com
bareknucklebaby.com barkerandmills.com barkmeowvets.com
barrettpowell.com basecampcoaching.com bcitma.ca
beautifullysmagazine.com beautifulmadhouse.com beckyshomestead.com
bedtimebunnies.com bellinghamcommunications.com benjaminnevarez.com
bennydemus.tv bensontheatre.org bespokesolutionsllc.com
beyondallreach.com bicyclette.to/ bigballershotta.com
bigheartedfamilies.org bigredsportsmachine.com bikramsc.com
bizcfo.com bizculturehackers.com blackmagicsurfboards.com
blackwomennaturalhairstyles.com blissbombed.com blog.amsterdamhospitality.com
blog.appareladdiction.com blog.avs.com blog.betterworldbooks.com
blog.brycemclaughlin.com blog.cobelle.net blog.drivendfw.com
blog.eztaxreturn.com blog.fusiontribal.com blog.ijpdesign.com
blog.ilsccp.org blog.kmnelsondesign.com blog.moreloans4u.com
blog.murats-toplist.com blog.naturalgumption.com blog.photographercafe.com
blog.planetbeauty.com blog.postalpix.com blog.semilshah.com
blog.sexandmetal.com blog.shopceek.com blog.starcircleacademy.com
blog.teethremoval.com blog.thesomersteam.com blog.turkgays.com
blog.webicurean.com blogaldo.com bluecorncafedurham.com
bluepicstudios.com bobbycherry.com bohnjello.com
bonuscodecasino.net bonvoyaging.com bookreviews.servantsofgrace.org
boujibuzz.com bprintgallery.com breakthrufitness.com
brewcoffeeshop.com brightonandhovenews.org brokenfilter.net
broncoburgersblog.com brooksharper.com browardstars.com
bryanhighnorseman.com bryce-mccormick.net btrandolph.com
burgerbeast.com businessturkeytoday.com buzzelicious.com
c2bmediausa.com calpolycru.com careersherpa.net
carifinonline.com carlalundblade.com carsalesprofessional.com
carsmartnow.com catapultgroups.com cathedraloflife.org
cathnewsusa.com cccm.org chaimommas.com
chamberofhoarders.com chapelofsanlorenzoruiznyc.org chattanoogafilmsociety.org
chcduluth.com cheap-sound.com cherylbyrnecommunications.com
chestercollege.edu chicksinaprons.com chihuahuanoticias.com
childbirth.amuchbetterway.com chimchum.com chinatownremixed.ca
chissenefrega.com ciaoflorentina.com citygirlbigworld.com
civicleague.ca claudemariottini.com claudiaguebel.com
cleaningcommercialjanitorial.com c-metinhibitors.com coldcasechristianity.com
coloradospringstennis.com comersano.com.ve community321.com
comoanilloaldedo.com.ve congo-liberty.com conocity.eu/
convergingworship.org corkbuzz.com cosonng.com
cotullavillage.com countryraptunes.com crazylegsskateclub.com
crbcnc.org critiquebooks.com crossfitsociety.com
crudepixel.com csrperspective.com cueafs.com
dailynutmeg.com dallastexasrealestateblog.com data-studies.com
davarts.org daytimedating.com dbakevlar.com
dcmetromedia.com deals.bestkidfriendlytravel.com debtdiagnosis.com
demgen.com democraciaenjuego.org desmaenok.silverhalogenide.com
developingrevenues.co.uk diabetesnews.com dianaelizabethblog.com
diariomomento.com diethood.com digitalentertainment7.co.uk
digitaltransformationconversations.com dinopuzzlegame.com dirtyfloordiaries.com
disabilitiesgrants.org discoverconnectbelong.com diyinspired.com
djlaz.com djschemes.com djzeem.com
docwoodproductions.com dollfacepersiankittens.com dominican-view.com
drizzleonline.com drumandbasics.com drunklastnight.com
dsbabble.com edgarcountywatchdogs.com edsheeran.us/
elbabuino.com elconcreto.com elgobiernodeocoa.com
elicastro.com ellysaysopa.com elpensamientosostenible.com
emanlandau.com e-mekdep.com emeraldlawnsaustin.com
emilybennington.com emilymiseroy.com emtheories.com
enlightenprinciple.com equationchurch.com everydayhdr.com
everythingkentuckyonline.com ewondertv.com experiencegccathens.com
exploriem.org expoitalyonline.it exposedprandevents.com
f1gplive.com faithwarren.com fatman2ironman.com
feel-great.net fishbone.net fitnessbyeva.com
fiveohseven.com flemingworks.com flockedmedia.com
fondoadaptacion.gov.co foodweek.info forexdiva.com
fotosonedirection.com foundationscollegeprep.org franchise.never-paint-again.com
franciscorangelescobar.info franciscorangelescobar.org freebiesdesign.com
freelancecafe.org fresnoweddingphotographyblog.com fxme.eu/
gamblerfalls.com gaming.links2click.com gardeninginthemitten.com
gaydailyhot.com geekvenezolano.com generoussavings.com
georgeandco.com georginesaves.com gerenciavenezolana.com
ginadanna.com girlfriendbooks.com girls20summit.com
glasshospital.com globaldairymarkets.com glutenfreebitches.ca
glutenfreehotproducts.com gofashiondeals.com gomezcatering.com
goodbyedebt.com goodfellaztv.com goowire.com
gotravelation.com gourmetestorie.com grahamemorrismp.co.uk
grandpighoroscope.com granportalaviacion.com grantsecrets.com
grassrootsnorthshore.org gratisjuegosdiarios.com graycatenterprises.com
groundupradio.com guerrillasmith.com guildcomplex.org
guysreviews.net hansenschoice-greenhealth.com happyhooligans.ca
harvardnsj.org harvestkansascity.org hauteofftherack.com
hazmatfreight.com hcicourse.com healingprojects.org
healthdataanalysisupdate.org healthupd8.blogspot.com healthyharbinger.com
healthylittlebit.com healthytastycheap.com heartbeetcafe.com
heathergaudiofineart.com hemetproductions.com herbanmarketplace.com
hexbeat.com hfrf.org.uk hiendfitness.com
higherstandards.org homeinthetrenches.com homemadedad.ca
hoorayhurrah.com hotdealsyo.com howtodropweighteasy.com
hrohumanresources.com hughneff.com huntervids.com
hustlevision.com hwcol.com iceagenow.info
idfscidnewbornscreening.org igglesblitz.com iiij.org
ilikemike.me imnaturallysimple.com incunabula.org
ingienous.com insidecuisine.com instantgrativacation.com
intelligentsia.com.mx interop.ixiacom.com iparented.com
iphone4s-online.com irishwildcat.com ironorchiddesigns.com
iviaggiatorinmovimento.it jabongcouponcodes.com jacksboatrental.com
jacksonvillevaletservice.com jacopofalleni.com jeagraphicdesign.com
jeanpierrelemaitre.com jenniferlshelton.com jenniferturliuk.com
jessicagimeno.com jesusfreak1623.com jiujitsufightingvideos.com
jobsinchina.co.in/ jodijacksonshollywood.tv joelvanvliet.com
joenetherworld.com johnrughcopywriting.com jonathan-hardesty.com
joshuagates.com juansemolina.com julesmann.co.uk
justagirl05.com justgamesretro.com justshootingmemories.com
jvmlending.com kaleynelson.com kansascitydealer.org
karendphoto.com kateordiecomics.com katesbeautyblog.com
katietalkstravel.com kellyncoetzee.com kiana.com
kidindependent.com kidsgoneraw.com kimnehrt.com
kimwilson.com kindnessbug.com knoptop.com
korywoodard.com kristinerudolph.com kumbiaphp.info
kvtproductions.com ladyplusbaby.com lahoguera.info
lalibreriadelamoda.com lampli.com laughingmyvagoff.com
launchyourcreativelife.com lauraleewalker.com laurengrodstein.com
leahsfabulousfinds.com learn2earnfresno.org learn-emailmarketing.com
learninginthegripofgrace.com leavenworthst.com legacy-control.com
legion-style.com leonamizrahi.com lesalonbridal.com
lesliespurlockblog.com letsgomobile.biz/ letsrestycle.com
lifefoodandbeer.com lifewithluggage.com likenagoya.com
limitlesslaura.com linuxdrops.com lisagcooks.com
liveencounters.net living.amuchbetterway.com livingcivil.com
livingincolorprint.com livingoffloveandcoffee.com livingstrongwellness.com
living-with-two-languages.info localmumsanddads.com loganswarning.com
louisvillewindowtreatments.com loungeurbain.com louslakeviews.com
lovinglightastrology.com luckyemily.com ludwigbc.com
luisemiliovelutini.net lulyb.com maagmagazine.com
macini-izle.com macsportsandsuds.com madebuyus.com
madisonmain.com madonnaofthemills.com magandafilipino.com
magetmd.com magnetizinglove.com makeupandmeg.com
makeupgameonpoint.com makingthedayscount.org mamaenred.com
manupchicago.com marcoguerrastudio.com mariostrim.com
marketsqueeze.com matchurself.com maxdarwinmagic.com
melissatoandfro.com melissavincent.com membership180.com
memyhairandthecity.com mercadofitness.tv metaljawcomics.com
mexicosinfrontera.com michaelgraycpa.com michaelwroberts.com
midlifecelebration.com mikebrownmma.com mikeclancytraining.com
mikeeagle.net milestomes.com milkdocumentary.com
mimiandchichi.com mindyindy.com minijuegosblog.com
mirappraisal.com misterpickypants.com mmaworldnews.com
mobile2013.org modaenvenezuela.com moderneye.com
momaconsulting.com mommymemusicclasses.com moneysavinghoney.com
monicarysavy.com monimeals.com morsipr.com
motherhoodlooms.com moto1gp.com movementsandnonsense.com
mslanavi.com mug-mouth.com mummysecrets.com
muserising.com musicandcelebrities.com musicplay.me
musictourreviews.com muziekis.nl/ mydirectdeals.com
mylifespeaks.com mymusicexec.com mysocalledmoney.com
mystoryisart.com naiaraperezdevillarreal.com natechutefoundation.org
naves4x4.com neilshh.com neosmarketing.com
nerdygirlmakeup.com neurosculptinginstitute.com nevisblog.com
new-pakistan.com news.apsmsystems.com newworlddistro.com
nflnationals.org nicknotnikki.com nicoleramsbey.com
njnutritionist.com nkccnews.com nollywoodwatch.com
noprop37.com normal-life.org northernwrites.co.uk
notforthecoolkids.com notguiltyadams.com novaplasticsurgery.com
obsceneworks.com olaysalcan.com oldiess.com
omaralkalouti.com omarsimpson.com omgobsessed.com
omizio.com onevoicenetwork.ca onthepathapp.com
options.garven.com orbitagay.com ottawarickshaws.ca
overlandsphere.com ozandroid.info paddyhome.com
pagescorner.com paintmeplaid.com pakistanmediawatch.com
papercraftplanet.net paradajz.net paralosangeles.com
parentingforpurpose.com park-life.org partywithmoms.com
passiveincometalk.com pastorchadgraves.com pathfindersolutions.org
patriotmash.com pattyebenson.org paulmaseberg.com
paulwhartonstyle.com pavingbricksvictoria.com peacechild.org
peacefultransition.ca pennellolane.com perfectdietprograms.com
perfildigital.com.co peruviantimes.com petwatchman.com
pheromones.com phillipgonzales.com phillycourtreporters.com
photographyawesomesauce.com physiciansnews.com plantbasedonabudget.com
platinumcheese.com platinumroofingandremodeling.com point-reyes-local.com
pornonomia.com porto-catering.ro postandgrant.com
poultrytimes.net practicalsmm.com precisionfilm.com
premierwinetraining.com preownedautoblog.com prepography.com
prettygirlblog.net printablecoupons4moms.com proallstars.com
proarmspodcast.com productivitycubed.com productivitygiant.com
progressivenectar.com promoblogger.nl prontopressrelease.com
property-advisors.net prosper-in-northumberland.ca prosperityseriesmemphis.info
proudtobeafilthyliberalscum.com prsaalaska.org pullingcorksandforks.com
q8autonews.com qualityservicemarketing.com qualtechsoftware.com
quietevents.com quitobebes.com racheldack.com
radiancepoweryoga.com radioalternativo.com ragnerdrok.com
ralphwalkerdesigns.com rapidproductdevelopment.biz rapperr.com
rarecrossfit.com raresoul.com rawrgg.com
readingdiva.com realfoodmoms.com realtvcritics.com
recapturefitness.com recipejourney.com redbutterflymovie.com
reelbastards.com reflectzyn.com reggielal.com
region.fifthking.com relumination.com remembertheice.com
removehairinstant.com remyscalza.com reparandoelcarro.com
reportecorporativo.com revampitinc.com rhucs.com
rickdebruhl.com rightonlefton.com ritawatson.com
robertforto.com robinwoodwest.com robpattinsonweb.com
rockfordsquire.com romgchamber.com rootsinalpharetta.com
rootsprovidence.com rositacortez.com roxwalkoff.com
royalbelly.com rpsmiles.com rubinascakeshoppe.com
rustygrape.com rwthomeremodeling.com safetyscents.ca
salesganasal.com salt396.com saltjunk.com
sammyko.com samplawskiphotography.com sang-froidridingclub.com
sanmembers.net sarahvonbargen.com sarasdfitness.com
sarinanow.com saucedomercer.com savagehabbit.com
savorx.com scandalousbeautyonline.com sceneintown.com
sciencewriters.ca scottdesigns.ca sdfoodtravel.com
sealink.org seaotters.com seattlenetimpact.org
seeyousoon.ca sennaya.com seojoblogs.com
serieproject.org servantsofgrace.org sewardcitynews.com
sfsthetik.com shalavee.com shelleyburgon.com
shindi.net shoptrulyyours.com sicanadam.com
simenonamartinez.com simplyglamo.com sittersattheshore.com
skatenugg.com slimsavers.com slowshooter.com
smartwomentravelers.com smokinvapor.com socceroverthere.com
sociallypresent.com somewhereinthemiddleblog.com sonicetweet.com
soundasthma.com soundmindindustries.com soundry.com
southernrockracing.com sovietkitchen.com spekular.com
spencerwatch.com sportingentrepreneur.com sportsbetsblog.com
sports-betting-winners.com sportsbrasandsippycups.com sportsfeedia.com
sports-kings.com sportspowerweekends.com squadmeet.com
squeezemoreprofit.com stage72.com staggsfitness.com
stankotibor.com starsandpopcorn.com startingup.com.br
stephenwalther.com stevensdisposal.com steverose.me
stoptennesseeforeclosure.com stopvih.org stpetesunsetrotary.org
stubbydog.org studentfood.ca studioseventeen.org
stylesubstancesoul.com suburbanturmoil.com sugarnova.com
summitsips.com sunscaperesortsblog.com superacionpersonal.mx
suzannahlipscomb.com suzannchristine.com swagsection.com
t0inpaydayloans.com talkofthetownatlanta.com tampabayhomes4sale.net
taniarubim.com teacherdad.com teachergeekischic.com
tech.links2click.com tech4pub.com techcovet.com
technesstivity.com techtools4mom.com terricole.com
teteracaliente.com texasmodeling.net thaidentalimplants.com
thatsbadass.com theasbestoscenter.com theavant-gardist.com
thebigoutside.com thebluestockings.com thebodiesofknowledge.com
thebridescoop.com theburtonwire.com thebusinessoffun.com
thechicagolifeblog.com theconnectedcause.com thecopywritingwebsite.com
thecraftycollaborative.com thedailybleat.com thedigitalvisual.com
thedoctorscloset.com thefakebaseball.com thefashionstatements.com
thegamersblog.com thegetgreenkey.com thehealthcoach1.com
thehybridathlete.com theibookemporium.com theiflife.com
thekennywormald.com theleanmarketer.com thelintscreen.com
thelovage.com themavenofsocialmedia.com themcbproject.com
themediamama.com themlmwhisperer.com themodernnetwork.com
themorningafter.us thepeoplestribune.com therenovatechurch.com
therynoshorn.com theshakespearestandard.com thesimpleyear.com
thesocialrobot.com thesonicspread.com thespankingspot.com
thestylemaven.com thetrumpetblog.com theveganbee.com
thewomenstyle.com titokang.com titsandsass.com
tjlaonline.com toddminerlaw.com todoloquehay.com
tomalaruta.com tommydarker.com top10watchbrands.com
topchicagorealestatenews.com topcountry.ca toplineleadership.com
torontonicity.com tptvexclusives.com traceyevelynbeautifulyou.com
tradingcomputersnow.com transformativehealth.info treasuresfp.com
treelovers.premieretreeservices.com trickstergallery.com trihamletnews.com
trivworks.com truenorthreports.com turning40.net
tururutururu.com tvwriters.org twelvebytwonyc.com
twopeasinapoddesigns.com tylersculpture.com ukbusinessforum.com
unionhugs.com unionjackplumbing.com unionsquareurgent.com
unnatural20comic.com upc.fm/ urbanalleyblog.com
urbangro.com urbanhitpromotions.com urbanouteaters.com
usacashpayday99.com usastockreport.com ushistoryscene.com
uswateralliance.org uvcblog.com vashikaranblackmagic.org
vectors-free.com vegan.xanaland.com vehq.net
vicentewolfblog.com vickilempweavil.com vickystein.com
victorychristiancoaching.com vientosdeboda.com viewpointwindows.com
vivaiquique.com vivascriva.com vivekkunwar.com
volleyball.addymeira.net wadhwa.com wardone.org
wayne-bowser.com webikeeugene.org wee1signaling.com
weeklykvariety.com westcoasthiphop.com where2transportation.org
wheretheclassroomends.com wherethegirlsgo.com wildbillspawnshops.com
will-greene.com windfires.com winnipegtdve.ca
wisciblog.com wizznotes.com wondherful.net
wordofmomradio.com worldghana.com worldgranderclub.com
wresttdngdom.com wresttdngwithdepression.com wtenews1.com
wubboomummy.com xsquisittdne.com yepgraphix.com
yffpforeignpotdcy.org yourcreativenative.com yourresetbutton.net
yousingiwrite.com yrcritic.com zacgorman.com
zbored.com zebragallerieblog.com zippybites.com
zoomfotobooths.com