{"id":31169,"date":"2026-11-10T10:39:58","date_gmt":"2026-11-10T09:39:58","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=31169"},"modified":"2026-11-10T10:40:00","modified_gmt":"2026-11-10T09:40:00","slug":"anatomy-of-an-almost-invisible-compromise-seo-cloaking","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/","title":{"rendered":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking"},"content":{"rendered":"\n

<\/p>\n\n\n\n

A museum, a restaurant, a hotel, a university, a government website. Nothing connects them except one anomaly: they all show up in search results related to online gambling, even though their business has nothing whatsoever to do with it<\/strong>.<\/p>\n

Their owners are not yet aware of it, but this is a sign that their website has been compromised<\/strong> and that attackers are hijacking its reputation to promote their malicious gambling platforms.<\/p>\n

CERT-Wavestone recently observed several cases of this kind. At first glance, nothing suggests a compromise. No defacement, no blank page on a Monday morning, no furious customer on the phone. These sites are up and running. In fact, they are running very well. Except that, on closer inspection, it turns out the attackers made a few specific changes to the source code. Changes that are invisible to visitors<\/strong>, but not to the bots and AI assistants crawling the web<\/strong>.<\/p>\n

\u00a0<\/p>\n\n\n\n

Tell me who you are and I\u2019ll tell you who I am<\/h2>\n\n\n\n

Let\u2019s take one of the cases we observed recently. Looking at the source code of the compromised application, the explanation quickly became clear. In the homepage PHP file, the attacker had slipped in a few lines of code, almost negligible among the rest. Here is a pseudo-code version:<\/p>\n

\"Example
Example of malicious pseudo-code<\/figcaption><\/figure>\n

The idea is as simple as it is effective. On every request, this small piece of code checks the User-Agent<\/strong> header of whoever is requesting the resource. If it is a search engine crawler (Googlebot, Bingbot, and the like), the server serves it an entirely different page<\/strong>, tailor-made, and then immediately stops execution. If it is a human visitor (with a standard browser User-Agent<\/strong>), the original content<\/strong> of the real site is displayed. And since humans never see the malicious version, no one suspects a thing<\/strong>.<\/p>\n

\"Diagram
Diagram of how the attack works<\/figcaption><\/figure>\n

This technique has a name: cloaking<\/em><\/strong>. It consists of serving different content depending on whether the request comes from a human user or a search engine crawler. It is a well-known black-hat SEO practice, long used to circumvent search engine rules<\/strong> and manipulate rankings<\/strong>. So the attacker didn\u2019t invent anything: they simply applied an old, tried-and-tested online marketing recipe.<\/p>\n

The filtering can also be based on other criteria<\/strong> besides the User-agent<\/strong>, which are even harder to detect:<\/p>\n

    \n
  • the visitor\u2019s IP address range<\/strong>: search engine crawlers use IP addresses belonging to known ranges that can be verified through reverse DNS<\/li>\n
  • the request\u2019s referrer<\/strong>: to trap only users arriving from a search results page.<\/li>\n<\/ul>\n

    There are also variants that involve no modification to the application\u2019s page code, with the branching logic placed in a web server configuration file (a .htaccess<\/strong> file containing a few RewriteCond<\/strong> directives on HTTP_USER_AGENT<\/strong> is enough).<\/p>\n

    With these methods, even the administrator visiting their own site sees a perfectly clean<\/strong> site. Only search engines see the poisoned version<\/strong>. And it is precisely this version that ends up indexed<\/strong>, ranked<\/strong>, and distributed<\/strong> in search results worldwide.<\/p>\n

    \u00a0<\/p>\n\n\n\n

    A matter of stealth<\/h2>\n\n\n\n

    Such stealth may seem surprising. After all, why not simply redirect all visitors<\/strong> to malicious sites?<\/p>\n

    Because that would be the best way to get caught<\/strong>: the slightest suspicious redirect would immediately alert both users and administrators of the infected site. That would run counter to the attacker\u2019s objectives. And to understand those objectives, we need to go back to what SEO cloaking really is: a malicious technique that aims to manipulate the search ranking of online content in order to push it to the top of the search results<\/strong>. And this ranking relies largely on reputation: a domain\u2019s age, its credibility and the number and quality of links pointing to it.<\/p>\n

    By serving search engine crawlers content stuffed with keywords<\/strong> and links<\/strong> pointing to their own domains, the attacker pushes their own sites up in the results for those keywords. Then, and above all, they transfer part of the compromised domain\u2019s credibility<\/strong> to their malicious links: a link posted on the website of a trusted hotel, restaurant, or university carries infinitely more weight in the eyes of ranking algorithms than a link posted on a site created the day before. The longer the poisoning lasts, the more effective the ranking boost<\/strong>: hence the value of staying stealthy for as long as possible.<\/p>\n

    It is a form of digital parasitism, almost elegant in its discretion: the attacker breaks nothing. They simply borrow the trust that others spent years building.<\/p>\n

    \u00a0<\/p>\n\n\n\n

    A widespread infection<\/h2>\n\n\n\n

    In our example case, while analyzing the HTML code injected into the PHP page, two terms kept coming up: \u201cslot gacor<\/strong>\u201d<\/em>. An expression that probably means nothing to you at first glance.<\/p>\n

    To understand these terms, you first need to know that online gambling has grown at a staggering pace over the past ten years or so, driven by millions of players around the world seeking thrills and potential winnings. In the jargon of this industry, one expression is widely used: \u201cslot gacor<\/strong>\u201d. Popularized within the online gambling community in Southeast Asia<\/strong>, and especially in Indonesia<\/strong>, it has become a true rallying keyword for slot machine enthusiasts<\/strong>. \u201cGacor<\/strong>\u201d comes from local slang and, in everyday language, refers to something that works exceptionally well or consistently produces positive results. Combined with \u201cslot<\/strong>\u201d, the term refers to a machine perceived as being on a winning streak, paying out frequent and sometimes substantial winnings.<\/p>\n

    These details may seem trivial, but they help us better understand the attacker\u2019s motivations<\/strong>, since the goal of the attack is to appear in search results when users type these keywords.<\/p>\n

    By typing these keywords into Google, we came across a large number of results<\/strong>, leading to hundreds of domains<\/strong> that, like our initial victim, have no apparent connection to gambling<\/strong> but host the same type of malicious content:<\/p>\n

    \"Websites
    Websites infected by SEO poisoning (1\/3)<\/figcaption><\/figure>\n
    \"Websites
    Websites infected by SEO poisoning (2\/3)<\/figcaption><\/figure>\n
    \"Websites
    Websites infected by SEO poisoning (3\/3)<\/figcaption><\/figure>\n

    As you can see, the victim profile is heterogeneous<\/strong>: nonprofits, universities, hotels, stores, restaurants, personal blogs. Organizations whose security and monitoring resources are generally very limited<\/strong>, or even nonexistent<\/strong>. They are more vulnerable, less monitored, and offer ideal ground for a compromise whose sole purpose is to last<\/strong> without being detected<\/strong>.<\/p>\n

    In addition, other terms from the same world<\/strong> rounded out our mapping of this type of infection:<\/p>\n\n\n\n
    \n
      \n
    • bandar slot<\/li>\n
    • slot777<\/li>\n
    • slot deposit pulsa<\/li>\n
    • togel slot<\/li>\n<\/ul>\n<\/td>\n
    		\n
      \n
    • agen slot<\/li>\n
    • slot gampang menang<\/li>\n
    • slot maxwin<\/li>\n
    • jackpot slot<\/li>\n<\/ul>\n<\/td>\n
    		\n
      \n
    • slot88<\/li>\n
    • mahjong slot<\/li>\n
    • daftar slot<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Other terms identified during the investigations<\/em><\/p>\n

      This list suggests that other keywords could be used to spot compromised sites. The terms we identified all belong to a subcategory<\/strong> of the gambling<\/strong> world, but it is a safe bet that other categories of vocabulary would uncover many more compromises.<\/p>\n

      \u00a0<\/p>\n\n\n\n

      Cloaking, one technique among many<\/h2>\n\n\n\n

      The case we handled illustrates just one branch of a much larger tree. SEO poisoning actually encompasses a whole range of techniques that share the same goal (hijacking search engine ranking mechanisms) but differ in their means and their purpose.<\/p>\n

        \n
      • Cloaking<\/strong>, which we have just described: two versions of the content, one for bots, one for humans.<\/li>\n
      • Conditional redirection<\/strong>: the site remains intact, but any visitor arriving from a Google results page is redirected to the attacker\u2019s platform. Direct access to the domain, on the other hand, triggers nothing (enough to fool an administrator testing their own site).<\/li>\n
      • Hidden link and text injection<\/strong> (spamdexing<\/em>): links are added to the footer, comments, or existing articles, then hidden with CSS (display:none, text the same color as the background, off-screen positioning). Here, there is only one version of the page: it is its actual content that gets polluted.<\/li>\n
      • Doorway pages<\/strong>: rather than modifying existing pages, the attacker generates hundreds of new ones, often placed in a rarely monitored directory (\/wp-content\/uploads\/<\/em>, for example), sometimes accompanied by a rogue sitemap to speed up their indexing.<\/li>\n
      • Parasite SEO<\/strong>: without even compromising a server, the attacker exploits open areas of legitimate platforms (forums, comment sections, free subdomains, public document repositories) to host their content and benefit from the host domain\u2019s reputation.<\/li>\n
      • SEO poisoning for malware distribution<\/strong>: the most offensive variant, where the ranked content is not a gambling platform but a fake download site. By ranking for very specific queries (software utilities, administrative document templates, niche legal questions), families such as Gootloader or SolarMarker lead victims to download the malware themselves.<\/li>\n<\/ul>\n

        In our cloaking case, the purpose is purely financial. The aim is not to infect visitors to the compromised site, but to capture search traffic and redirect it to betting platforms. This largely explains the care taken to remain undetected.<\/p>\n

        \u00a0<\/p>\n\n\n\n

        How does the attacker get in?<\/h2>\n\n\n\n

        To insert lines of code into a PHP file, you first need to be able to write to the server. Cloaking is not an intrusion vector; it is a payload. Upstream, there is always an intrusion chain and it is not necessarily sophisticated.<\/p>\n

        The vectors most frequently observed in this type of attack:<\/p>\n

          \n
        • A vulnerable application component:<\/strong> mainstream CMSs (WordPress first and foremost, but also Joomla, Drupal, PrestaShop, Moodle) rely on an ecosystem of extensions and themes whose development quality and security maintenance are not guaranteed. A published vulnerability, an unapplied patch, and exploitation can become trivial. This entry point deserves all the more attention since these CMSs mostly rely on PHP, which has recently been hit by critical vulnerabilities.<\/li>\n
        • Insufficiently controlled file uploads:<\/strong> Contact form with attachments, photo gallery, r\u00e9sum\u00e9 upload area: as soon as the check is based on the declared extension rather than the file\u2019s actual type, and the destination directory allows code execution, uploading a webshell<\/em> gives the attacker persistent write access to the entire directory tree.<\/li>\n
        • Remote code execution (RCE):<\/strong> Whether it stems from insecure deserialization, local file inclusion combined with log poisoning, or command injection, it immediately provides the required level of access.<\/li>\n
        • An exposed administration interface:<\/strong> CMS console, phpMyAdmin, hosting panel, deployment interface: if it is accessible from the Internet with no IP address restriction or second factor, it is only as strong as the password protecting it.<\/li>\n
        • And many others<\/strong><\/li>\n<\/ul>\n

          Whatever the vector, the next step is the same: establishing persistence that will survive a site update<\/strong>. It is this persistence, more than the injection itself, that explains why so many “cleaned”<\/strong> sites end up reinfected a few days later.<\/p>\n

          \u00a0<\/p>\n\n\n\n

          Detection and remediation<\/h2>\n\n\n\n

          What makes this compromise particularly interesting is that, under certain conditions, it can be carried out without triggering a single alert in security tools<\/strong>. No abnormal traffic, no malicious binary executed, no known signature: just a few extra lines of code in a source file.<\/p>\n

          \"Example
          Example of a WordPress blog compromise<\/figcaption><\/figure>\n

          There is no universal method<\/strong> for identifying whether a page is a victim of SEO cloaking. However, one simple method is to query the site while successively presenting the User-Agents of the various search engine crawlers<\/strong>, then compare the result with that of a standard browser<\/strong>. Any content discrepancy can be a potential sign of compromise<\/strong>. If both versions are identical, the technique is probably not present.<\/p>\n

          Here is an example request to test a site as a standard browser:<\/p>\n\n\n\n
          curl -A \"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/126.0.0.0 Safari\/537.36\" https:\/\/example.com\/ -o human.html<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          The second one replays exactly the same request, posing as Googlebot:<\/p>\n\n\n\n
          curl -A \"Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\"\u00a0 https:\/\/example.com\/ -o googlebot.html<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          All that remains is to compare the two responses:<\/p>\n\n\n\n
          diff human.html googlebot.html<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          On a clean site, diff<\/em> returns nothing, or only minor variations (CSRF token, timestamp, session ID). On a site affected by cloaking, the difference is usually obvious: two entirely different documents, often of very different sizes and with different entropy. The comparison can be repeated with the user-agents of other search engine crawlers (Bingbot, DuckDuckBot, YandexBot, etc.).<\/p>\n

          Other good practices can help detect the compromise of a domain more quickly:<\/p>\n

            \n
          • monitor the integrity of application files in production<\/strong>, in order to detect any modification of the source code, including in web server configuration files<\/li>\n
          • analyze, through a simple search such as<\/strong> site:mydomain.tld<\/em>, what search engines have actually indexed from your domain<\/li>\n
          • check search engines\u2019 webmaster tools, <\/strong>which report the appearance of unknown pages, spikes in incongruous keywords, and any manual actions to downrank the site.<\/li>\n<\/ul>\n

            Finally, a note that applies to remediation: restoring the modified files is not enough<\/strong>. Without identifying the initial intrusion vector and removing the persistence mechanisms, reinfection is only a matter of time.<\/p>\n

            The order of operations also matters. Start by removing everything the attacker left behind<\/strong>: injected code, and any added extensions, accounts, and files. Next, rotate all secrets<\/strong> (CMS administration, database, FTP\/SSH, etc.), then invalidate all open sessions<\/strong>. Finally, update every outdated component<\/strong>: CMS, themes, extensions.<\/p>\n

            If the extent of the compromise cannot be established with certainty, reinstalling<\/strong> or restoring<\/strong> from a backup predating the intrusion<\/strong> remain the safest options. On one condition: the necessary hardening must be applied before the site goes back online. Otherwise, it will be compromised again in the same way.<\/p>\n

            \u00a0<\/p>\n\n\n\n

            This type of attack illustrates a reality that is sometimes forgotten: an attack is not always meant to make noise or cause damage. Here, stealth is the goal !<\/strong> The longer the compromise goes undetected, the more it pays off for the attacker.<\/p>\n

            SEO poisoning was initially aimed solely at search engines<\/strong>. But as AI agents browse the web on behalf of their users, we should expect this strategy to evolve<\/strong> to target them as well. The mechanism is the same: only the list of User-Agents changes. The stakes, however, are no longer the same. Content crafted for a search engine gains a few places in a ranking. Content crafted for an AI agent becomes an answer<\/strong>, passed on to the user with the endorsement of the legitimate domain<\/strong> being consulted, without the user ever having seen the page.<\/p>\n

            Monitoring a website should not stop at what humans see. Every now and then, we also need to ask what our friends the bots and AI agents see. Because one website can hide another<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"

            A museum, a restaurant, a hotel, a university, a government website. Nothing connects them except one anomaly: they all show up in search results related to online gambling, even though their business has nothing whatsoever to do with it. Their…<\/p>\n","protected":false},"author":1573,"featured_media":31154,"comment_status":"open","ping_status":"closed","sticky":false,"template":"page-templates\/tmpl-one.php","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2777,3922,3273],"tags":[5209,5211,3480,3487,4818,2772,5219,3422,4012,5223,5216,5218,5132,5221,5222,5224,5225,5212,5220,5214,5215,5210,5213,5226],"coauthors":[4876],"class_list":["post-31169","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-digital-trust","category-deep-dive-en","category-ethical-hacking-indicent-response-en","tag-agen-slot","tag-bandar-slot","tag-cert-en","tag-cert-w-en","tag-compromission","tag-cybersecurity","tag-daftar-slot","tag-detection-en-2","tag-incident-response","tag-indexing","tag-jackpot-slot","tag-mahjong-slot","tag-remediation","tag-search-engine","tag-seo","tag-seo-cloaking","tag-seo-poisoning","tag-slot-deposit-pulsa","tag-slot-gacor","tag-slot-gampang-menang","tag-slot-maxwin","tag-slot777","tag-togel-slot","tag-user-agent"],"acf":[],"yoast_head":"\nAnatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight<\/title>\n<meta name=\"description\" content=\"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight\" \/>\n<meta property=\"og:description\" content=\"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/\" \/>\n<meta property=\"og:site_name\" content=\"RiskInsight\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T09:39:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-10T09:40:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1116\" \/>\n\t<meta property=\"og:image:height\" content=\"744\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Evenson Jeunesse\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Evenson Jeunesse\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/\"},\"author\":{\"name\":\"Evenson Jeunesse\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#\\\/schema\\\/person\\\/a5b119ee593e1ff5413508d6fa66648b\"},\"headline\":\"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking\",\"datePublished\":\"2026-11-10T09:39:58+00:00\",\"dateModified\":\"2026-11-10T09:40:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/\"},\"wordCount\":2363,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Cover.png\",\"keywords\":[\"agen slot\",\"bandar slot\",\"CERT\",\"CERT-W\",\"Compromission\",\"cybersecurity\",\"daftar slot\",\"detection\",\"Incident response\",\"indexing\",\"jackpot slot\",\"mahjong slot\",\"Remediation\",\"search engine\",\"SEO\",\"SEO cloaking\",\"SEO poisoning\",\"slot deposit pulsa\",\"slot gacor\",\"slot gampang menang\",\"slot maxwin\",\"slot777\",\"togel slot\",\"User-Agent\"],\"articleSection\":[\"Cybersecurity & Digital Trust\",\"Deep-dive\",\"Ethical Hacking & Incident Response\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/\",\"name\":\"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Cover.png\",\"datePublished\":\"2026-11-10T09:39:58+00:00\",\"dateModified\":\"2026-11-10T09:40:00+00:00\",\"description\":\"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Cover.png\",\"contentUrl\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Cover.png\",\"width\":1116,\"height\":744},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/2026\\\/11\\\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/\",\"name\":\"RiskInsight\",\"description\":\"The cybersecurity & digital trust blog by Wavestone's consultants\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#organization\",\"name\":\"Wavestone\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"contentUrl\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"width\":50,\"height\":50,\"caption\":\"Wavestone\"},\"image\":{\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/#\\\/schema\\\/person\\\/a5b119ee593e1ff5413508d6fa66648b\",\"name\":\"Evenson Jeunesse\",\"url\":\"https:\\\/\\\/www.riskinsight-wavestone.com\\\/en\\\/author\\\/evenson-jeunesse\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight","description":"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/","og_locale":"en_US","og_type":"article","og_title":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight","og_description":"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.","og_url":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/","og_site_name":"RiskInsight","article_published_time":"2026-11-10T09:39:58+00:00","article_modified_time":"2026-11-10T09:40:00+00:00","og_image":[{"width":1116,"height":744,"url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png","type":"image\/png"}],"author":"Evenson Jeunesse","twitter_misc":{"Written by":"Evenson Jeunesse","Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#article","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/"},"author":{"name":"Evenson Jeunesse","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/a5b119ee593e1ff5413508d6fa66648b"},"headline":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking","datePublished":"2026-11-10T09:39:58+00:00","dateModified":"2026-11-10T09:40:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/"},"wordCount":2363,"commentCount":0,"publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#primaryimage"},"thumbnailUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png","keywords":["agen slot","bandar slot","CERT","CERT-W","Compromission","cybersecurity","daftar slot","detection","Incident response","indexing","jackpot slot","mahjong slot","Remediation","search engine","SEO","SEO cloaking","SEO poisoning","slot deposit pulsa","slot gacor","slot gampang menang","slot maxwin","slot777","togel slot","User-Agent"],"articleSection":["Cybersecurity & Digital Trust","Deep-dive","Ethical Hacking & Incident Response"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/","url":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/","name":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking - RiskInsight","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#primaryimage"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#primaryimage"},"thumbnailUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png","datePublished":"2026-11-10T09:39:58+00:00","dateModified":"2026-11-10T09:40:00+00:00","description":"SEO cloaking: how attackers alter the code of legitimate websites to promote gambling platforms in search results while staying invisible to visitors.","breadcrumb":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#primaryimage","url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png","contentUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/11\/Cover.png","width":1116,"height":744},{"@type":"BreadcrumbList","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/11\/anatomy-of-an-almost-invisible-compromise-seo-cloaking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.riskinsight-wavestone.com\/en\/"},{"@type":"ListItem","position":2,"name":"Anatomy of an \u201cAlmost\u201d Invisible Compromise: SEO Cloaking"}]},{"@type":"WebSite","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","name":"RiskInsight","description":"The cybersecurity & digital trust blog by Wavestone's consultants","publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.riskinsight-wavestone.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization","name":"Wavestone","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","contentUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","width":50,"height":50,"caption":"Wavestone"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/a5b119ee593e1ff5413508d6fa66648b","name":"Evenson Jeunesse","url":"https:\/\/www.riskinsight-wavestone.com\/en\/author\/evenson-jeunesse\/"}]}},"_links":{"self":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/31169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/users\/1573"}],"replies":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/comments?post=31169"}],"version-history":[{"count":9,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/31169\/revisions"}],"predecessor-version":[{"id":31201,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/31169\/revisions\/31201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/media\/31154"}],"wp:attachment":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/media?parent=31169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/categories?post=31169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/tags?post=31169"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/coauthors?post=31169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}