Has anyone seen this kind of google cache spam before?

[JaspalX]

Has anyone seen this kind of 'hack'?

When looking at a site recently I found the Google cache version (from 28 Oct) strewn with mentions of all sorts of dodgy looking pharma products but the site itself looked fine.

The site itself is www.istc.org.uk

Looking in the source of the pages you can see the home pages contains:

Browsing as googlebot showed me an empty page (though msnbot etc. returned a 'normal' non-pharma page).

As a mildly amusing aside - when I tried to tell the istc about this, the person answering the phone clearly didn't believe me and couldn't get me off the line fast enough! Needless to say they haven't fixed it a week after being told.

[RyanKent]

What tool did you use?

The problem is the tool likely spoofed the User Agent name, but not the IP address, so if the cloaking was well designed, it would present your test tool with the normal webpage while still presenting Googlebot with the hacked page.

[JaspalX]

Hi Ryan, I tried the mozbar and seobrowser

[RyanKent]

It's only a guess, but anyone who can cloak to set a webpage to appear differently for the Googlebot user agent can also restrict the cloaking to a range of IP addresses which Google normally uses. It would be sloppy not to do such because everyone has the ability to easily detect the cloaking otherwise, and the bad guys are trying to make that difficult.