What is search engine poisoning?
Search engine poisoning, sometimes called SEO poisoning, is spam with a weapon in it. Attackers build or hijack pages that rank for queries people are likely to search, a trending news story, a popular software download, a celebrity, a tax form, a brand name, and point those pages at something harmful: a fake login screen, a download that carries malware, a support line run by scammers. The search engine is the delivery system; the ranking techniques are the same black hat tools used for ordinary spam, from keyword stuffing and cloaking to hacked sites and link networks.
It is distinct from malvertising, which uses paid ads for the same purpose, though the two often run together. And it is distinct from a hacked site that merely shows spam: poisoning aims at the visitor, not just the ranking.
Why it matters
Why search engine poisoning matters
Brands are targets twice. First as bait: attackers rank fake pages for a brand's name, its products, its login page or its customer service number, and the brand's own customers walk into the trap because they trusted the result. Second as hosts: a brand site with a vulnerable plugin can be hacked and its pages turned into poisoning pages, so the brand's domain, with its authority and its reputation, is the thing doing the harm. Google then flags the site as dangerous, and every visitor sees a warning before the homepage.
Either way the damage is trust, and trust is the thing a brand site exists to build.
In practice
How search engine poisoning works in practice
- 01
Attackers watch what people search, often using the same trend tools marketers use, and create pages fast. They hack sites with weak security, usually through outdated content management systems and plugins, and inject hidden pages or redirects. They cloak, showing the crawler a legitimate page and the visitor the harmful one. They build link networks to push the pages up. The campaigns run for days or weeks before the engines catch them, which is long enough.
- 02
Defending a brand means doing two things. Keep the site from being hijacked: update the platform and plugins, use strong authentication, monitor Search Console's security issues report and watch for pages you did not publish. And watch the results for your own name: search the brand, its products and its support terms regularly, report fake pages to Google, and make sure the real login and support pages rank clearly so customers find them first.
Watch out
What people get wrong about search engine poisoning
Assuming it only targets big names. Attackers go where searches are and where sites are weak, and a mid-sized brand with an unpatched site and a loyal customer base is an easier target than a bank. The security issues report in Search Console is checked by far fewer people than it should be.
The other mistake is treating a hacked site as an IT problem only. Once Google flags the domain, search traffic collapses and the brand's reputation takes the hit. Cleaning the site is step one; requesting a review in Search Console and watching the results for weeks afterward is the rest.
