Black Hat Search Engine Optimization

Just recently I discovered a way to hijack other websites and deliver spam to search engines by exploiting cross site scripting (XSS) security holes in PHP scripts employed on the target webserver. The hacker either gains from injecting links to his (mostly porn) sites or by pushing a completitor’s website out of business this way.

Now there is an entry in the SiteProNews Blog about an interview Matt Cutts gave to webmaster radio, also talking about Black Hat SEO, hacking websites by installing a cloaking CGI script on the target website, doing pretty much the same thing as with the XSS exploit. Jim Hedger is asking a few good question that hopefully will be answered by Matt Cutts about why Google can’t detect such website hijacking instead of delisting the website from the index after detecting the cloaking.

I have a question to add: Why is Google still sticking with the concept of disclosing their visits to the webservers? Why transmitting „Googlebot“ as user agent, why alway using the same IP addresses? Wouldn’t it be a big step in spam fighting if the spammers just don’t know (or at least can’t say for sure) which user actually is the Google crawler and which user is just a regular, human user?