How spammers brought us millions of clicks
In August, unknown individuals hijacked the Galaxus forum, filled them with spam and used them to rank highly on Google in India and Pakistan. The result: 250,000 spam pages, 3.3 million clicks in a single day, and a penalty from the search engine giant.
One Saturday in August, Galaxus’s visitor traffic curve shot into space: our online shop was visited 74 million times that day, with an additional 3.3 million clicks. Looking at the graph, daily traffic from the previous days shrank to a flat line at the bottom. But this success didn’t come from air conditioners or a new game console – it came from search terms that aren’t in our range.
Five days, a gap, 250,000 pages
Between the 12 and 17 August, attackers exploited a technical vulnerability in our forum. Using automation, they created approximately 250,000 English-language threads filled with links to pornography, dubious chat groups and streaming sites. The use of English was no coincidence: the pages consistently appeared at the top of Google search results in India and Pakistan, two of the world’s largest English-speaking search markets.
The numbers during those five days: 7.5 million clicks and 159 million impressions. 3.3 million clicks came from India and 460,000 from Pakistan. Back in Switzerland, the search terms «galaxus» and «galaxus.ch» continued to be the main ones directing users to our store on Google. Meanwhile, in India, «xxx» topped the list, followed by Satta King (an illegal form of gambling in India) and «sexy video».
«Our click rate skyrocketed. Normally, that’s a reason to celebrate. In this case, however, it was a warning,» says Hennadii Sivashov, Senior Product Owner at Digitec Galaxus, who analysed the incident.
The incentivised traffic trick
The attackers also linked to each newly created thread from their own websites. This way Google indexed them faster. According to Hennadii, this was followed by a second trick, which experts refer to as incentivised traffic: «People and bots were instructed to specifically click on the hijacked Galaxus pages in the search results.» Google evaluates user satisfaction with search results based on clicks, among other things. Simply put: the more clicks a site gets, the higher it ranks in search engine results.
One of our pages briefly ranked seventh on Google in India for the popular porn search term «xxx». It received about 600,000 clicks in just three days. Anyone who clicked on the Galaxus result didn’t find a coffee maker, but rather links to the attackers’ websites. There, ad networks pay per thousand views – the industry thrives on volume.
Google is cracking down, and we’re cleaning things up
On 20 August, Google took action against so-called user-generated spam, specifically targeting the URL pattern of the threads (i.e. galaxus.ch/de/forum). These pages could no longer be found on Google from that day forward. Meanwhile, two development teams at Galaxus were working on a fix: «We removed our forum from Google’s index and temporarily stopped allowing new threads or comments,» explains Hennadii. In addition, the approximately 250,000 spam pages soon began returning an HTTP status code of 410. The message to search engines: this page is permanently gone. On the same day, Galaxus submitted a request for review to Google. Two days later, the search engine giant reversed its decision.
Bouncers for the Community
To prevent this from happening again, a new rule applies to all forms of user-generated content on Galaxus and Digitec: participation in forum threads and comments on blog posts or product pages is now limited to users who have purchased at least one physical product from Galaxus or Digitec in their last 20 orders. So anyone who places an order for only vouchers or digital products won’t be able to proceed.
What’s left: a dubious reward
There are, however, two pieces of good news: first, our systems handled the sudden surge without any problems. Second, on 18 August, Google congratulated us with a badge for reaching 10 million clicks in 28 days. A milestone we’ve been working toward for years. One which we now, unfortunately, have to mark with an asterisk.
At Digitec and Galaxus, I’m in charge of communication with journalists and bloggers. Good stories are my passion – I am always up to date.
News about features in our shop, information from marketing and logistics, and much more.
Show all
