Crisis SEO Case study

Hidden phishing code created 300,000+ indexed pages and damaged traffic and sales

Logged-in administrators saw a normal website. Other visitors were randomly shown German-language phishing content while the original domain stayed visible. Stopping the injection was only the first stage of a recovery that lasted more than six months.

0 +

Unwanted pages indexed by Google

0 +

Months of traffic and sales recovery

STARTING POINT

The Situation

The malicious code deliberately behaved differently for logged-in administrators and other visitors. Routine checks therefore returned a clean-looking website while random users encountered phishing content on the client’s domain.

Problem

Admin checks looked clean

The injected code did not execute for logged-in administrators.

Problem

Visitors saw phishing content

Some users were redirected to German-language phishing pages without leaving the visible domain.

Problem

Google indexed the attack at scale

More than 300,000 unwanted pages entered the search index.

Problem

Traffic and sales declined

The security incident became an organic visibility and commercial problem.

WHAT MADE IT COMPLEX

The Challenge

Conditional execution concealed the incident from the people most likely to check the website. The business and its customers were not receiving the same experience.

Even after the code was stopped, Google still held hundreds of thousands of malicious URLs associated with the domain. Security cleanup could stop new damage, but it could not erase the search history immediately.

Malicious behavior was hidden from administrators

Visitors were affected randomly rather than consistently

Phishing content appeared under the trusted domain

The indexation problem continued beyond the technical cleanup

Our Approach

We separated incident containment from the longer SEO recovery required afterward.

Step

Reproduce the hidden behavior

We investigated the website from outside the normal logged-in administrator experience.

Step

Identify the malicious injection

We traced the conditional code responsible for the phishing behavior and unwanted pages.

Step

Stop further damage

The immediate priority was to contain the attack so new malicious behavior and URLs would not continue expanding.

Step

Reverse the indexation damage

The recovery then focused on the more than 300,000 unwanted pages associated with the domain.

Step

Rebuild traffic and sales

We continued the SEO recovery after the security incident itself had been stabilized.

“

This attack was extremely difficult to understand because the website appeared normal whenever an administrator checked it. Back2Rank reproduced what other visitors were seeing, identified the hidden phishing behavior, and explained the scale of the indexation damage without creating false expectations about a quick recovery. We received clear updates throughout the security and SEO work. The process took more than six months, but we always understood what had been fixed and what still needed time

Katerina, Managing Partner at Cleopatra Adult Stores

The Results

The attack stopped quickly. The search damage took more than six months to repair.

The phishing behavior was contained, but traffic and sales recovery continued for over six months. Hundreds of thousands of unwanted indexed pages could not disappear from Google’s understanding of the website overnight.

The case demonstrates why a hacked website needs two connected plans. Security work stops the active threat. SEO recovery addresses what search engines and customers encountered while the threat was live.

0 +

Unwanted pages indexed by Google

0 +

Months of traffic and sales recovery

Removed the malicious code, but traffic still has not returned?

We can investigate what users and Google actually saw, contain the SEO damage, and build a recovery plan for the search index.