💊
The Pharma Hack — The Most Common Website Spam Attack
The pharmaceutical hack is the single most common form of website spam injection. Attackers gain access to your server — usually through an outdated plugin, CMS vulnerability, or weak admin password — and inject thousands of hidden pages or hidden text blocks containing pharmacy keywords: "buy viagra", "cheap cialis", "generic levitra", "online pharmacy no prescription".
Why it is so dangerous: the injected content is nearly always hidden from regular visitors using CSS (display:none, visibility:hidden, white text on white background) or cloaking — so you see nothing wrong when you visit your own site. But Google indexes the spam content, and your domain starts ranking for pharmacy terms. This damages your domain's reputation, triggers manual actions from Google, and can result in your entire site being de-indexed.
This tool scans the visible text content and hidden elements of your page for pharma keywords and flags anything suspicious immediately.
🎰
Casino & Gambling Spam — The Second Most Common Injection
Casino and gambling spam follows the same pattern as the pharma hack but targets a different set of keywords: "online casino", "free slots", "sports betting", "poker online". This type of spam is extremely common because gambling sites pay premium rates for links on authoritative domains.
The injection is often done through compromised WordPress plugins, outdated themes, or vulnerable contact forms. The spam links are hidden in your page's HTML using the same CSS hiding techniques as the pharma hack — invisible to you, visible to Google. Your site effectively becomes a link farm for gambling operators without your knowledge.
The Japanese keyword hack is a variant specifically targeting Japanese casino and brand keywords. It creates large numbers of auto-generated pages on your domain in Japanese, which then rank in Japanese search results pointing to scam shopping sites. Our tool detects unexpected Japanese or Chinese characters on non-Japanese pages as a primary signal of this attack.
🕵️
Cloaking — When Hackers Hide Spam Specifically from You
The most sophisticated spam injections use cloaking: serving different content to search engine crawlers than to regular users. When you visit your own page, you see the normal content. When Googlebot visits, it sees thousands of spam keywords, hidden links to casinos and pharmacies, or even entire different pages. Because you never see the spam, the attack can run undetected for months.
This tool detects cloaking by fetching the same URL twice — once with a standard browser user-agent and once with a Googlebot user-agent — then comparing the word count and content of both responses. A significant difference (over 30%) is a strong cloaking signal that warrants immediate investigation.
Note: Some legitimate content (lazy-loaded sections, personalised content, JavaScript-rendered elements) can cause minor differences. This is why the tool flags differences above 10% as a warning and above 30% as a critical issue, so you can investigate the specific cause.
🔐
Obfuscated Code — eval(), base64_decode(), and Hidden Iframes
When attackers inject malicious scripts into your site, they almost always obfuscate the code to avoid detection. The most common techniques are: eval() — executes a string as JavaScript code at runtime, allowing the malicious payload to be hidden inside an innocuous-looking variable. base64_decode() — decodes a base64 string at runtime, hiding the actual malicious code from static inspection. gzinflate() / gzuncompress() — decompresses code at runtime for the same obfuscation purpose.
Hidden iframes (zero-width, zero-height, or display:none) are used to load external malicious pages invisibly inside your page. These can be used for drive-by downloads, clickjacking, or invisible redirects that expose your visitors to malware.
Legitimate sites do occasionally use eval() in analytics scripts or base64 in email obfuscation — so context matters. This tool flags these patterns so you can investigate the specific code, not as definitive proof of a compromise.
