tedster - 6:08 pm on Feb 19, 2006 (gmt 0)

This combination of factors seems quite unusual:

1. The hijack seems to work from all three major search engines.
2. The hijack does not seem to work with any other kind of site access.
3. And yet, the hijack is not consistent -- it only occurs some of the time, on some clicks even from the same SERP

Have I got that right?

It's #3 that really gives me pause. Thoughts of some kind of DNS gaming come to mind -- a very esoteric pursuit, if true. There are some "theft of service" exploits that can work against some server configurations (see [httpd.apache.org...] )but I would expect those to either work all the time or none of the time -- so the fact that only search engine traffic seems to be affected (and even that is only some of the time) works against that idea.

The serp shows YOUR url -- but any kind of framing/scraping/redirect effect should show their URL. And again, this would be 100% ofn the time, not just some of the time.

In short, those three points seem to work against each other, each one ruling out the situations that the others seem to indicate.

I'd suggest that you take these steps:

1. Spend some time verifying that each of those 3 points above is accurate.

2. Examine your pages for any kind of code injection - such as an injected iframe attack. I know your host said all was fine on the server, but you still should verify that for yourself.

3. Check current server logs against a baseline from the period when things were working well. Are you still seeing the same level of SE referers? And even more telling, does the SE traffic first hit your server and then go elsewhere, or does you server never see those clicks.

I doubt that inurl: allinurl: site: and so on are going to give you the evidence you need to take this further. However, you might do a check with the Yahoo Site Explorer [siteexplorer.search.yahoo.com] just to see if anything looks odd. I also doubt this will show you much that is new, but you never know.

Best wishes on this one -- you'll really need to pin down the sypmtoms with certainty, and that can be hard when something seems to happen only a percentage of the time.