@TempleUniv, you have been hacked, and it looks like it's been the case for over a month now. You should remove this old DNS record ASAP.

Another victim of this subdomain takeover group I am tracking. This takeover took place in early November and has gone unnoticed since then.

Check out the traffic graph below; this was a big success for them. 👇

RapidAPI has two free do-follow backlinks opportunities, one where you can control the anchor text and one where you can't.

Examples of below 👇 (Both examples are spam pages, but you can use these backlinks for anything.)

This is a perfect way to get more items you control on brand SERPs you care about. This example ranks just below the homepage and is a doorway page to the brand's site.

This site ranks well on brand SERPs, and creating a page is free. It will also give you a backlink, but it's no-follow.

Example of it in action 👇

Using WikiArt as a parasite, two rival account sellers hold the first and second positions here.

Additionally, to this, it's ranking well for terms related to fraud 👇

WikiArt has become a powerful free parasite with the latest Google update.

It's ranking for high-volume terms. 👇

It also has a do-follow backlink with custom anchor text. I've been unable to submit pages successfully, but I will keep trying.

Here's another free backlink (do-follow but marked as UGC). The pages also rank, making them perfect parasites.

Posts need 'moderator' approval, but it seems automated since my new accounts are approved within minutes.

I see evidence of an attempt at moderation on Bulb's side, but it's clear they aren't winning.

Another parasite/free backlink site. Fair warning, though: these links are marked as nofollow and UGC.

However, the pages rank, and you can control the anchor text (Example Below 👇)

The final redirect page depends on your tracked attributes. The traffic is sold through Voluum.com, but this can easily be changed.

It's unclear how much they'll earn. Ahrefs probably underestimate the traffic.

Client-side JavaScript will redirect you if you've been referred by Google (i.e., clicked in from a Google search). This suggests they might lack control over the web server and only have FTP access.

Here is the code (comments are in Indonesian). Payout method 👇

The pages are low-quality spam with no affiliate links or adverts. However, this is only when you manually browse them.

This Ahrefs graph clearly illustrates the reason: Quickly generate a large amount of traffic and sell it before anyone notices and takes away access.

Here's how the cloaking works. 👇

It currently ranks for gems like 'unblocked games 66' and almost anything you can imagine.

This subdomain was taken over sometime between the 27th and 28th of November.

It's now a generic LLM spam site aimed to rank for as many keywords on Google as possible to see what ranks (spray and pray). This works because Google views it as a high-authority site (backlinks and a gov site)

It seems to be an old local loyalty app to boost local small businesses. However, the app store listings are gone, so it's likely abandoned.

A UK gov site has been hacked and is being used to rank cloaked spam pages on Google.

In this 🧵, I'll show you how it works.

I don't think they have noticed yet, so hopefully, this post alerts them.