.xyz invasion in a niche we are keeping an eye on

[Shai]

Hi All,

We have discovered a strange phenomena and I cant really work out the purpose of it. Can anyone shed some light?

Basically, for a whole range of niche keywords, in fact, almost every single site that sells, advises or talks about a certain niche that we keep our eyes on has been affected by the invasion.

So, in short, each site has had hundreds of links pointed at them from .xyz domains. All of these domains are names in relation to the niche. These links are NOT anchor heavy but just the url of the site its linking to. These xyz domains do not have any links pointing at them and are clean.

However, to see the links, you have to browse the site using Google or Bing user-agent. Anything else get redirected to the exact same photography related site.

This is untypical of a negseo attack because:

1. There are no anchor heavy links
2. ALL of the niche is covered. Normally, negative seo targets the first 2 or 3 results. Not the first 5 pages.

The photography related site everything is being redirected to is nothing special. Crappy blog with no way of fixing country let alone location. All sites are whois protected in the same way so its quite obvious they are owned by the same person.

So what's the point of this? Just referral traffic from people checking their link profile? I must have clicked on it and diverted 4 or 5 times so you can see how this could add up.

Am I missing something even more simple?

[not2easy]

That kind of redirect uses cloaking - showing visitors different content than search engines. I've seen that tactic used for gaming AdWords QS.

If you run AdWords campaigns yourself you may see the Google AdsBot UA visiting your site. If you do not run any Google AdWords campaigns on your site you can prevent the problem you describe by adding a few lines to your robots.txt file:

User-agent: Adsbot-Google
Disallow: /

I don't know the Bing equivalent offhand but if the Bing UA is redirected, it probably has an ads-bot UA also.

This is not the "only" scenario for using cloaking. You can read more about it from Google: [support.google.com...]

[jmccormac]

Have run a survey of all new gTLD websites based on the 01 August 2016 zones. There is a fair bit of non-30n redirection going on in some of the new gTLDs including .XYZ gTLD. There are also non-gTLD sites being served where no redirect has been set up. One Chinese site is being served about 19,000 times under different URLs. Another curious appearance was invalid webpages (no HTML tags) with just <script> tags and the outbound URL.

In terms of security, if a .top, .party, .bid or .pub link is seen in the link graph of a European site, it is almost always due to a link injection hack.

There is also a dodgy Chinese SEO promotion software package that uses pages of links deep in sites to promote others.

Regards...jmcc

[Shai]

Thanks for the feedback but I'm still perplexed as to the actual goal of this. I.e why have those links being built to so many sites? I'm well aware of what cloaking is but don't understand the point of it in this context.

Just to recap:

Hundreds of links are appearing in Majestic/Ahrefs all coming from .xyz domain. Here is one example:

bluewidgetinformation.xyz has a link to a few widget related sites.

However, when you click on bluewidgetinformation.xyz to visit the site to check it out, it redirects to a photographyrelated.com website.

If you use user agent switcher for chrome or any other user agent spoofer/browser to view the site as Googlebot, it takes you to the real site containing the links.

What's the point of it?

There are no adverts on any of the site.

[jmccormac]

There's more than one search engine and Google isn't the dominant player in the Asian market. I've seen some compromised sites (link injection) use this kind of switch and bait strategy with search engines being served one set of pages and human users being served another. Is the photography related site selling anything (particularly counterfeit goods etc)?

Regards...jmcc

[Shai]

No nothing. Its a pretend photography service site. There is a very basic contact form but no email, number and no address so its actually difficult to say which country he is from let alone town/area.

The only thing I can think of is traffic through people checking their link profile. Maybe the idea is to gain thousands of hits/day for the photography site and then sell it? The amount of sites that have been affected is incredible.

[seomaximizer]

Hi,

I would create a filter in Google Analytics and also disavow all those domains just in case :)

Hope this helps!

[30K_a_month]

I have a site around stock and investments.

4 months after its been running i suddenly have around 40 .xyz's that point to my site all around the same niche... example buyforexshares.xyz etc etc

I dont understand why somone would do this.

[agent_x]

I have these but the ones pointing to my site redirect to dating offers. Could it be that by linking out to authority or highly ranked sites, they can get the odd click here and there, so scaled up by hundreds of thousands it amounts to enough revenue to make a profit?