![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/10/16210132/SL-seo-spam-featured-990x400.jpg) When analyzing the content of websites in an attempt to determine what category it belongs to, we sometimes get an utterly unexpected result. It could be the official page of a metal structures manufacturer or online flower shop, or, say, a law firm website, with completely neutral content, but our solutions would place it squarely in the "Adult content" category. On the surface, it is completely unclear how our systems arrived at that verdict, but one look at the content categorization engine's page analysis log clears it up. ## Invisible HTML block, or SEO spam The website falls into the questionable category because it contains an HTML block with links to third-party sites, invisible to regular users. These sites typically host content of a certain kind – which, in our experience, is most often pornographic or gambling materials – and in the hidden block, you will find relevant keywords along with the links. These practices are a type of Black Hat SEO, or SEO spam: the manipulation of website search rankings in violation of ethical search engine optimization (SEO) principles. Although there are many techniques that attackers use to raise or lower websites in search engine rankings, we have encountered hidden blocks more frequently lately, so this is what this post focuses on. Website owners rarely suspect a problem until they face obvious negative consequences, such as a sharp drop in traffic, warnings from search engines, or complaints from visitors. Those who use Kaspersky solutions may see their sites blocked due to being categorized as prohibited, a sign that something is wrong with them. Our engine detects both links and their descriptions that are present in a block like that. ## How hidden links work Hyperlinks that are invisible to regular users but still can be scanned by various analytical systems, such as search engines or our web categorization engine, are known as "hidden links". They are often used for scams, inflating website rankings (positions in search results), or pushing down the ranking of a victim website. To understand how this works, let us look at how today's SEO functions in the first place. A series of algorithms is responsible for ranking websites in search results, such as those served by Google. The oldest and most relevant one to this article is known as PageRank. The PageRank metric, or weight in the context of this algorithm, is a numerical value that determines the importance of a specific page. The higher the number of links from other websites pointing to a page, and the greater those websites' own weights, the higher the page's PageRank. So, to boost their own website's ranking in search results, the malicious actor places hidden links to it on the victim website. The higher the victim website's PageRank, the more attractive it is to the attacker. High-traffic platforms like blogs or forums are of particular interest to them. However, PageRank is no longer the only method search engines use to measure a website's value. Google, for example, also applies other algorithms, such as the artificial intelligence-based RankBrain or the BERT language model. These algorithms use more sophisticated metrics, such as Domain Authority (that is, how much authority the website has on the subject the user is asking about), link quality, and context. Placing links on a website with a high PageRank can still be beneficial, but this tactic has a severely limited effect due to advanced algorithms and filters aimed at demoting sites that break the search engine's rules. Examples of these filters are as follows: * Google Penguin, which identifies and penalizes websites that use poor-quality or manipulative links, including hidden ones, to boost their own rankings. When links like these are detected, their weight can be zeroed out, and the ranking may be lowered for both sites: the victim and the spam website. * Google Panda, which evaluates content quality. If the website has a high PageRank, but the content is of low quality, duplicated, auto-generated, or otherwise substandard, the site may be demoted. * Google SpamBrain, which uses machine learning to analyze HTML markup, page layouts, and so forth to identify manipulative patterns. This algorithm is integrated into Google Penguin. ## What a Black Hat SEO block looks like in a page's HTML markup Let us look at some real examples of hidden blocks we have seen on legitimate websites and determine the attributes by which these blocks can be identified. ### Example 1 This example utilizes a simple CSS style,

. This is one of the most basic and widely known methods for concealing content; the parameter display: none; stands for "do not display". We also see that each invisible

section contains a set of links to low-quality pornographic websites along with their keyword-stuffed descriptions. This clearly indicates spam, as the website where we found this block has no relation whatsoever to the type of content being linked to. Another sign of Black Hat SEO in the example is the attribute rel="dofollow". This instructs search engines that the link carries link juice, meaning it passes weight. Spammers intentionally set this attribute to transfer authority from the victim website to the ones they are promoting. In standard practice, webmasters may, conversely, use rel="nofollow", which signifies that the presence of the link on the site should not influence the ranking of the website where it leads. Thus, the combination of a hidden block ( display: none;) and a set of external pornographic (in this instance) links with the rel="dofollow" attribute unequivocally point to a SEO spam injection. Note that all

sections are concentrated in one spot, at the end of the page, rather than scattered throughout the page code. This block demonstrates a classic Black Hat SEO approach. ### Example 2

سكس انجليز wfporn.com سكس كلاسيك مترجم

فيلم سكس keep-porn.com سكس هندى اغتصاب

desi nude tumbler desixxxv.net kanpur sexy video

www wap sex video com pornorado.mobi sexy film video mp4

mom yes porn please movsmo.net yes porn please brazzers

xxx download hd fuxee.mobi fat woman sex

bangalore xxx bigassporntrends.com sexy video kashmir

xnxx sister sex wetwap.info blue film a video

tamilschoolsexvideo tubetria.mobi sex free videos

سكس من اجل المال مترجم yesexyporn.com نسوان شرميط

kamapishi desisexy.org savita bhabhi xvideo

aflamk2 pornvideoswatch.net نيك ثمينات

hentaifox futanari hentaitale.net hen hentai

video sexy wallpaper povporntrends.com bengolibf

persona 5 hentai manga younghentai.net toys hentai

This example demonstrates a slightly more sophisticated approach to hiding the block containing Black Hat SEO content. It suggests an attempt to bypass the automated search engine filters that easily detect the display: none; parameter. Let us analyze the set of CSS styles:

. The properties position: absolute; height: 0pt; width: 0pt; remove the block from the visible area of the page, while overflow: auto prevents the content from being displayed even if it exceeds zero dimensions. This makes the links inaccessible to humans, but it does not prevent them from being preserved in the DOM (document object model). That's why HTML code scanning systems, such as search engines, are able to see it. In addition to the zero dimensions of the block, in this example, just as in the previous one, we see the attribute rel="dofollow", as well as many links to pornographic websites with relevant keywords. The combination of styles that sets the block dimensions to zero is less obvious than display: none; because the element is technically present in the rendering, although it is not visible to the user. Nevertheless, it is worth noting that modern search engine security algorithms, such as Google Penguin, detect this technique too. To counter this, malicious actors may employ more complex techniques for evading detection. Here is another example:

Ganhe Rápido nos Jogos Populares do Cassino Online 580bet Cassino bet 7k: Diversão e Grandes Vitórias Esperam por Você Aposte e Vença no Cassino leao – Jogos Fáceis e Populares Jogos Populares e Grandes Prêmios no Cassino Online luck 2 Descubra os Jogos Mais Populares no Cassino john bet e Ganhe 7755 bet: Apostas Fáceis, Grandes Oportunidades de Vitória Jogue no Cassino Online cbet e Aumente suas Chances de Ganhar Ganhe Prêmios Incríveis com Jogos Populares no Cassino bet7 Cassino pk55: Onde a Sorte Está ao Seu Lado Experimente o Cassino 8800 bet e Ganhe com Jogos Populares Ganhe Facilmente no Cassino Online doce Aposte e Vença no Cassino bet 4 Jogos Populares e Grandes Premiações na f12bet Descubra a Diversão e Vitória no Cassino bet7 Aposte nos Jogos Mais Populares do Cassino ggbet Ganhe Prêmios Rápidos no Cassino Online bet77 Jogos Fáceis e Rápidos no Cassino mrbet Jogue e Ganhe com Facilidade no Cassino bet61 Cassino tvbet: Onde a Sorte Está Ao Seu Lado Aposte nos Melhores Jogos do Cassino Online pgwin Ganhe Grande no Cassino today com Jogos Populares Cassino fuwin: Grandes Vitórias Esperam por Você Experimente os Melhores Jogos no Cassino brwin

Aside from the parameters we are already familiar with, which are responsible for concealing a block ( height: 0px, color: transparent, overflow: hidden), and the name that hints at its contents ( \

Query Builder