[ramenmeal]

> If a visitor's user agent doesn't match a selected search engine, the browser is redirected either to the hacked website's normal homepage, or to an evidently fake, recently created, online marketing website

Could someone explain this bit to me? Don't follow it.

[Spivak]

1. Site is compromised.

2. When a search engine crawler goes to the site it displays the attackers content.

3 When a ‘normal’ users visits the site it will display the original site or a generic marketing site.

It’s a tactic to prevent the original owner from knowing their site was hacked.

[CodeWriter23]

It’s called cloaking. Spider gets one page, visitor gets a different one.

[walshemj]

And search engines do check for this they don't only crawl as Googlebot.