SEO spam hides someone else's links and pages inside a compromised website.

SEO spam plants links or replacement pages on a legitimate website to push unrelated sites into search results. The code arrives as changed HTML, JavaScript or PHP and can keep the visible site intact while search crawlers receive the spam.

compromised website
  -> hidden link block, remote frame or content loader
  -> gambling links or a controller-selected page
  -> search crawler discovers the planted content
  -> visitor still sees the original site or a doorway page

Links hidden in plain source

The simplest injections add casino and betting links to the page, then hide the container with display:none, zero height or a position thousands of pixels off-screen. Other versions write several advertorial blocks in different languages. The links remain in the HTML even when a person looking at the page sees nothing unusual.

Some loaders fetch keyword and URL pairs from a remote server and build the anchors after the page loads. We have also found a WordPress injection dressed as Google Tag Manager: a zero-size frame requests the link document, and a companion script renders its configured backlink list into the page footer.

Doorway content from a controller

A remote controller gives the operator more choices than a fixed link block. One injected loader sends the current page URL to a private-blog-network controller. The reply can add backlinks, replace the whole document or redirect the browser. A full replacement turns the compromised URL into a doorway page without changing the site's stored article.

LinkHiding moves the link-server address into an Ethereum contract. Its WordPress PHP reads the address, requests a site-specific link set and writes those links into the page. Updating the contract or remote response changes what infected sites publish.

What we see across infected sites

Month	New sites
September	459
October so far	1,048

98% of the SEO-spam sites captured since 25 September run WordPress. Of those, 56% run WordPress 7.1. Of the 64 sites recaptured at least 25 days after their first match, 44 still served SEO-spam code (69%).

Checking a site

Compare the page source with the rendered page, then inspect the scripts and frames loaded after the first response. Search for:

• casino, betting or advertorial links that nobody on your team published
• containers placed far off-screen, set to zero height or hidden with CSS
• zero-size frames labelled as analytics or Tag Manager
• scripts that fetch keyword and URL lists, then create anchors in the body or footer
• Base64 data-script blocks that contact a content controller
• complete page replacements or redirects on URLs that should show normal site content

Remove the injected HTML, JavaScript or PHP and clear every server, plugin and CDN cache. Compare themes, plugins and server configuration with trusted copies, review administrator and hosting access, then check the logged-out page again.