BrandMinded · SEO · Website security
Spotting a Japanese spam hack across 5 client sites
Irregular traffic in GA4 led me to run a site audit, which uncovered a Japanese keyword hack caused by a vulnerable plugin. I coordinated the cleanup across 5 client sites.
The challenge
A hack no one knew about
While reviewing monthly reports, I noticed irregular traffic in GA4 on a client site. I ran a site audit in Semrush, and it flagged a large number of backlinks in Japanese text. For an English-language business, that was an immediate red flag. Digging deeper confirmed a Japanese keyword hack: spam pages created on the site to rank for unrelated searches, hidden from the owner but visible to Google.
I then audited all 8 sites I report on and found the same attack on 5 of them, across healthcare, wellness, tent rental supply, and interior design. None of the clients knew anything was wrong.
- Role
- Digital Data Coordinator, BrandMinded
- Timeframe
- August 2025 – Present
- Tools
- GA4 · Semrush · Search Console · WPMU DEV · Flywheel
What I did
From warning sign to recovery
- Spotted the warning sign: flagged irregular traffic in GA4 during monthly reporting.
- Ran a site audit: found 3,400 broken links tied to spam pages in Japanese, confirming a keyword hack.
- Checked every account: audited all 8 client sites and found 5 affected.
- Coordinated the cleanup: worked with Flywheel to remove infected files and restore clean sites.
- Repaired how the sites appear in Google: fixed favicons the hack had broken in search results, so each client's brand showed correctly again.
- Got Google to recrawl: resubmitted sitemaps in Search Console so Google would recrawl the clean pages and drop the spam ones.
Results
What changed
The audit
3,400 broken links, traced to spam
A site audit uncovered spam pages with Japanese titles that the client never created. That confirmed a Japanese keyword hack and gave the team a clear list of what to clean up.
Source: Semrush site audit. Client URLs blurred.
Recovery checklist · all 5 sites
- Infected files removedCleaned up with Flywheel
- Favicons restoredEach brand shows correctly in search results
- Sitemaps resubmittedGoogle recrawled the clean pages in Search Console
- Spam pages droppedClean pages back in Google's index
The recovery
Clean sites, correct in Google
After the cleanup, I fixed the favicons the hack had broken and resubmitted sitemaps in Search Console so Google recrawled the clean pages and dropped the spam. All 5 affected sites were restored.
Takeaway
Small anomalies can signal big problems
One unusual traffic pattern uncovered a hack affecting 5 client sites. This case shows why I treat anything that looks off in a report as worth investigating. Reading data closely is how problems get caught early, before they cost clients the visibility they've built.← All case studies