A businesses worst nightmare is being under attack online on multiple fronts that you have very little control over. Most businesses that contact me feel they are “under attack” but when you dive into the issue it normally involves a short spurt of some online malice directed at the business that can be easily managed with a sound strategy in pretty short order.

So when I was contacted today by a UK nationwide business that said they are under attack, I took my usual approach of lets see what this “attack” looks like before we start freaking out, and boy oh boy this one is enough to keep any business owner awake at night.

 

Online Attack on Multiple Fronts

Normally an online attack of a business is over pretty quickly and the attacker moves on with their life pretty quickly when they realise spending time (time is money) and spending actual hard cash has not had any visible impact on the targeted business and they have better things to be doing.

In this instance, the business is being attacked with multiple fake negative reviews on their Google Business Page, fake clicks on their AdWords Ads and a pretty Stunning Negative SEO campaign aimed at their website.

The one positive side to this particular online attack is that the business has a very good reputation online and in the real world, where 80% of their business is repeat or word of mouth. The problem however, is build up of negative reviews are starting to impact the direct emergency calls and the fraudulent AdWords clicks that can burn through an entire days budget in a couple of hours, which is returned by AdWords after investigating, but this takes time and affects immediate cash flow.

So what can be done about this, if anything, and how can a business protect themselves from similar attacks.

 

Fake Negative Google Reviews

Fake negative reviews posted onto their Google business page is the most recent attack with thirty negative reviews appearing every week for the past two weeks.

 

The initial attempt of fake reviews were pretty clumsy and the attacker used the same account to post negative reviews for all similar businesses in the area which were quickly removed by Google My Business. Since then they have upped their game and used one account to post the negative review with a few positive reviews for unrelated businesses in the area.

These fake reviews have no chance of removal because in Google’s eyes they have not broken any review guidelines, to you and me, we can see a pattern but to Google that pattern has to proven and or the actual review to violate a review Guideline. You can read multiple articles on here where I show the idiocracy that is Google reviews.

Advice

Thankfully this business is in the UK and you cannot publish what the heck you feel like about a businesses or person. In this instance I advised the business to bundle all the reviews together which are deemed fake and intended to harm the business into one legal case and get have their solicitor send them off to Google UK to defend.

Google UK is the publisher of these reviews as they can be viewed in the UK, therefore the onus is on the publisher to prove that these are not fake or intended in a malicious way to harm the business.

 

Malicious AdWords Clicks

AdWords which is a paid for product have some serious algorithms to detect malicious clicks and protect businesses from this kind of attack.

The problem is that these are investigated after the fact, which means you have already had your entire days budget blown out by the attacker and your account is typically only credited back after the months bill has been paid, which can lead to cash flow issues.

Advice

If this was business with one location I would make sure that their Ads were targeting that specific location which would make it difficult for an attacker to find so many different IP addresses within that area that they could switch to during a time period to click on their Ads.

Because they are a national business, I advised splitting up their campaigns by region and being specific with target regions. This has the same desired affect as a single location and IP availability.

 

Negative SEO Attack on Website

This was the longest running part of the attack, starting in July and lasting into October.

 

Again this is a pretty amateurish attempt and looking at the position tracking, the site did have a spike in positions for some unwanted keywords but I believe that Google Bot understood the situation and has returned the site back to its originals positions.

Advice

Monitor links on a weekly basis and disavow all dodgy domains in Google search console.

Although Google looks to have taken this attempt in its stride, its better to be safe and disavow them.

Businesses cannot afford to let their guard down. You should regularly monitor your online assets, you never know when some nutter gets in in their head that its a good idea to try an ruin your business.