Negative SEO, or just an idiot?

Hello all,

There is a strange guy that is replicating well established greek websites, changes the anchor text for all website links to random keywords varying from monasteries and God up to viagra and cialis (but the link url remains the original).

This way, my main money website is getting links from crappy replica websites with ridiculous anchor text on all links.

I am not sure if this guy is after me or if he is just copying the entire .gr tld , but the fact that all his websites are in the energy niche (which is my niche) and the fact that the number of websites pointing crappy links to my money site is raising, guide me thinking that this is not bad luck, but negative seo.

What this guy does is registering free .tk , .cf and .ga domains from the freenom service,
he gets hosting from a very well unknown hosting provider and hides these websites behind cloudflare proxies.

I don't know how he does it, but he is managing replicating everything, from forums, wordpress websites, plain html websites and everything (I would really like to know how he does this), and the impressive thing is that when i check his websites using builtwith.com, they seem to have installed the original CMS (but they don't).

It also seems that the replication process is done exactly at the moment when someone asks for a specific url. What I mean is that his websites are all empty at the beginning (only the frontpage exists) and when someone clicks on a link on the replica, the mechanism behing his websites copies the content from the original to the replica at this very moment.

Examples of his work:

http:// www. *** trestaore.cf --> replicating energyworld.gr
http:// www. *** tuupareja.tk --> replicating mama365.gr
http:// www. *** stylesitxe.ga --> replicating monachos.gr
http:// www. *** thewayouvt.tk --> replicating monachos.gr again
http:// www. *** fianeqt.tk/ --> replicating find4me.gr
http:// * budapester.tk/ --> replicating an energy government website
http:// * oysuncaklar.tk --> replicating an energy blog
and some more.

I have contacted freenom service (they did nothing), his hosting provider (he did nothing) and cloudflare (they took his websites down but he re-uploaded without cloudflare).

I know I can disavow his links, but I prefer to finish the whole thing and find out how he does what he does, so I can protect my websites in the future.

If someone knows how he does all these things, I would be grateful if you shared your knowledge.

Thank you all for your time.

Disavow his links, that is the only option.

Yes, maybe, but I have to find how he does it (or even better find who he is).

I want to meet this sob.

It looks some kind of hacking if he is managing to replicate all.
I remember once my site had some hacking issues and my host provider was not unable to do anything and all of a sudden, while looking out for a solution, i came across one hacking website where discussion about my website was going on.
I think you should check out those kind of websites to know how he is doing it

yes LarryBerry is right you need to check those kind of website for better understanding

Negative seo some time people do to rank some popular keyword. Most CPA and PPD landing page get traffic with that, and rank easily. But this work for few months only.

Here you will need really expert and must have large budget.You cant solve this by own.
I will give a try to answer your situation.
You have 2 ways just to make some structure of the answer.
1 One
If OP disavow links he will not solve problems at all.As i understand here is question of replicas of websites with some kind of method.
Really if you don't take down websites you will have issue in rankings because google will see double content.Google in time will penalize you if he starts to trow some powerfull PBN links or SAPE on his replicas and will harm on long way.
They use free domains because they know will waste them.
This is 1 scenario.
2 One
Hacking method with creating Mirrors of your website but put on crappy domains with backlinks and anchors from adult industry.
Whats the matter here.
If he overpopulate at least one link which google take as on yours websites with using powerfull indexing service then that link will count on your website.
This is some crappy work from Indaa or Saudi Arabia people.
At least i know that they use such techniques to do Negative SEO.

I want to meet this sob.

SEOWorlock said:

Here you will need really expert and must have large budget.You cant solve this by own.
I will give a try to answer your situation.
You have 2 ways just to make some structure of the answer.
1 One
If OP disavow links he will not solve problems at all.As i understand here is question of replicas of websites with some kind of method.
Really if you don't take down websites you will have issue in rankings because google will see double content.Google in time will penalize you if he starts to trow some powerfull PBN links or SAPE on his replicas and will harm on long way.
They use free domains because they know will waste them.
This is 1 scenario.
2 One
Hacking method with creating Mirrors of your website but put on crappy domains with backlinks and anchors from adult industry.
Whats the matter here.
If he overpopulate at least one link which google take as on yours websites with using powerfull indexing service then that link will count on your website.
This is some crappy work from Indaa or Saudi Arabia people.
At least i know that they use such techniques to do Negative SEO.

Click to expand...

Thank you very much for taking the time to answer. And alI the other members that wrote above. I really appreciate it.

The strange thing is that he is not building links to adult content websites or viagra websites.

He uses random anchor text , which is not necessarily about adult and gambling, but I would say more like a random keyword dictionary.
for example, "travel guide", "monastery", "Cheap train tickets", "Some that you cannot understand the meaning"

All internal links are changed to the domain level only, while the rest of the url remains the same. The domain is switched from the original to the replica.
All external links are the originals.

So the only thing the "hacker" achieves is to affect negatively the websites these links point to.

I am not sure that all this mess is a product of hacking.
I tested the replica engine as one of the replicated victim websites belongs to me.

and i think that the engine behind these replica websites is a hosted online copier
that is copying the original content and attaches it to the replica the exact moment somebody clicks on a url on the replica website.
so if you visit the replica website and start clicking here and there, you create more and more crappy links pointing to your website.

I totally agree with you on the harm that he might do to me in the future,
for the time being I see reduced traffic in overal,
but I havent seen drop in SERPS,

The question is what engine he uses Does anybody know anything about such a copying engine?

This is domain poisoning similar to DNS poisoning.This technique is used to steal your traffic and because your rankings are not affected I assume that traffic is rerouted to his own money site.Again you need expert on this.

I did a small research after your post (thanks for the tip), and If I got it well, domain poisoning is a situation when someone asks for my domain, but some of the times he is redirected to the hacker's domain instead.

This is not my problem. When you enter the domain of my website in the url bar, you always goto my website (never redirects to the replica website)

I think the only thing he does is to install a copying mechanism on his hosting space that copies target websites.

Domain poisoning dont work all the time,constantly it can be put ON OFF.

This is not the problem here.
When you ask for my website, you go to my website. There is no redirection.
The problem is just copied content with junk links from a junky website. If it was only one website, I wouldn't even bother.
But seeing all these websites make me think it is not a coincidence, and I have to find out how this attack is done.

Most possible, this is my case

https://blog.sucuri.net/2016/04/cloned-website-stealing-google-rankings-seo-serp.html

Or better described here

https://null-byte.wonderhowto.com/how-to/hack-like-pro-clone-any-website-using-httrack-0152420/

With a program like this maybe.....

https://dollysites.com/en/