The Japanese keyword hack is a takeover pattern where an expired English-language site is repurposed to host spam in Japanese, Thai, Chinese or Korean characters. The domain keeps its English backlink profile while the new owner floods it with pages in a non-English language, trying to rank in foreign language search results and funnel traffic to ads or scam sites. It is a recognizable pattern in expired domain spam, and it is a reason to reject the domain if you find it.
The pattern: English site becomes East Asian spam
The typical Japanese keyword hack looks like this. A domain had real English content: a blog, a small business website, a local service site. The domain accumulated backlinks with English anchor text, a strong referring domain profile and topical relevance. Then the domain expired and the previous owner did not renew.
A new buyer registers or backorders the domain, then clears out all the original content and replaced it with thousands of pages in Japanese, Thai, Chinese or Korean characters. The pages typically target keywords in those languages and monetize with ads, affiliate links or redirects to scam sites.
The attacker is exploiting the domain's existing backlink equity. The domain's authority metrics say it is trustworthy because it has a history of legitimate English sites linking to it. Those links have nothing to do with the new spam pages, but search engines initially treat the incoming links as votes for the new content. The spam site can rank in Japanese search results faster than a new domain would.
The spam pages in the archive look nothing like the original English content. Page titles are in Japanese characters. Page content is keyword-stuffed Japanese text. The layout is generic and designed for ad placements. If you compare the first capture before the hack with the captures after, you will see an abrupt shift from English to a completely different language.
Why it is so common
This pattern is common because it is effective and the barrier to entry is low. An expired domain with decent metrics and English backlinks can be bought or backordered for modest fees. The spam pages can be auto-generated using keyword research tools and basic templates. The domain is easy to find because expired domain lists and marketplaces are public.
The attacker relies on the time lag between uploading the spam and search engines catching up with it. A domain with existing backlinks and authority can rank spam pages quickly. By the time the abuse is discovered and the pages are taken down, the attacker may already have made money from ad clicks and affiliate sales.
The language choice (Japanese, Thai, Chinese or Korean) is deliberate. These searches have less competition from established sites than English searches. A spam page in Japanese can rank for keyword combinations that would be impossible in English on a similar domain. The attacker is targeting search traffic from non-English speakers in Asia, where spam monetization is common.
Spotting it fast: titles and script
You can recognize a Japanese keyword hack in thirty seconds by looking at the page titles in the Wayback Machine captures.
Open the domain in the Wayback Machine and look at the calendar. Scan the captures and compare the page titles. If all the captures from 2020 say "Smith Plumbing | Local Service" and the captures from 2022 onward say things in Japanese characters, you have found the pattern.
Look for three signs:
-
Script change: The page goes from Latin characters (English) to a non-Latin script (Japanese hiragana and katakana, Chinese hanzi, Thai script). This is always visible in the title and in the page source.
-
Title pattern: The original English titles are replaced with titles that look like keyword strings: many hyphens or underscores separating words, high repetition of the same characters, no natural sentence structure. Japanese keyword spam often uses titles like "キーワード - キーワード - keyword - keyword" (repeated keywords separated by hyphens).
-
Abrupt transition: There is a specific date or month where the transition happens. Before that date, all captures are English. After that date, all captures are the foreign language. This shows the domain was taken over, not gradually changed.
You do not need to read Japanese to spot this. You just need to recognize that the script changed completely.
Traces in the link profile
The backlink profile is the strongest sign that a domain was hacked rather than legitimately sold to a new owner.
If you look at the links pointing to a genuinely hacked domain, they are all in English, all targeted at the original English site, and all created before the hack. Links like "plumbing services" or "emergency repairs" point to a domain now serving Japanese spam about medicine, gambling or crypto.
A legitimate handoff to a new owner would result in new links being added that match the new topic. New links would be in the language of the new content. But a hacked domain receives no new relevant links because the attacker did not build any. The attacker just uploaded spam and hoped the old links would carry the domain.
This mismatch is visible in tools that track referring domains and anchor text. If a domain has hundreds of linking domains with English anchor text from 2020 and earlier, but the current pages are in Japanese, that is a strong signal of a hack rather than a legitimate topic change.
A domain with English backlinks ranking Japanese spam content is a low-quality signal, and such a domain may lose ranking and traffic over time. But early on, the domain can rank because the old authority is still there.
Hack vs legitimate change of hands
Not every language change is a hack. A domain can legitimately be sold from an English-speaking owner to a Japanese, Thai or Chinese owner who then repurposes it for the new language market.
A legitimate change of hands looks different in the archive and the link profile:
-
Transition period: The new owner might keep the old English content live for a while, then gradually add new content in the new language. There is an overlap period, not an abrupt flip.
-
New content quality: The new content is real, not auto-generated spam. Page structures are reasonable, titles are natural, and the pages are designed for users, not just for keyword rankings.
-
New links: The domain accumulates new links in the new language from sites relevant to the new topic. The link profile gradually becomes mixed (some English, some in the new language) rather than staying English while the site is all in a new language.
-
No monetization red flags: A legitimate site will have a clear business model. A spam site will have aggressive ad placements, suspicious affiliate links, or obvious scams.
If a domain was legitimately sold to a new owner and repurposed, there will be evidence of effort and planning. If a domain was hacked, there will be chaos: an abrupt transition, no new topical links, auto-generated pages and obvious monetization tactics.
The Wayback Machine and the link profile tell the story. Check the archive history and compare the original content with the new content. Look at the anchor text on the referring domains. If they do not match the new language or topic, you are looking at a hack.
Why it is a straight reject
A domain with a Japanese keyword hack pattern should be rejected immediately, even if the metrics look good.
First, the domain is currently hosting spam. The spam pages are auto-generated, keyword-stuffed and designed for ad clicks, which is the kind of content Google's spam policies target. hunter.domains cannot see Google manual actions or algorithmic penalties, so you cannot rule one out.
Second, buying a domain in this state puts you in a difficult position. You would need to remove all the spam content, rebuild the site with legitimate content and then see how Google treats it. If the domain has already been penalized, that penalty may carry forward to any content you put on it.
Third, the domain's status as a known spam vector is visible to security vendors and spam researchers. The domain may be on reputation blacklists. Email sent from that domain may be blocked. Some users may have the domain in their blocklists even after it is cleaned.
If you are backordering or buying from an auctioneer while the domain still hosts spam, the risk is too high. The spam history stays in the archive whoever owns the domain next, and hunter.domains rejects domains whose script and topic both changed.
Always check the archive for signs of spam history and verify that the domain's link profile matches its content topic. The Japanese keyword hack is distinctive enough that you will spot it in seconds if you look at the titles and script. If you find it, move on.
Frequently asked questions
Can a domain recover from the Japanese keyword hack?
Technically, yes. If the spam is removed and legitimate content is added, the domain can eventually be repurposed. However, the recovery is slow and uncertain.
Google has not published a "probation" rule for domains with spam history, so the outcome is hard to predict. New content may take time to be assessed, and any earlier manual action or algorithmic demotion could still apply, which hunter.domains cannot see.
The domain may also be flagged on reputation lists and blacklists. Removing the content does not automatically remove the domain from those lists, so check each list and follow its removal process.
In practice, most buyers skip domains with clear spam history and buy a fresh domain instead, for example from the live list of expired domains. The risk and time required to rehabilitate a hacked domain are usually not worth the small amount of authority it retains.
Is a language change always spam?
No. A domain can be legitimately sold to an owner in a different country and repurposed for a new language and market. This is not spam.
The difference is in how you can tell. A legitimate change of hands has continuity: there is overlap of old and new content, new links in the new language come from relevant sites, and the new content is made for users, not for ad clicks.
A hack has a break: an abrupt transition, no new topical links, auto-generated pages and obvious spam monetization.
If you see a domain that switched from English to German, for example, look at the referring domains. If they are all English and no new German-language sites are linking to it, that is suspicious. If new German-language backlinks are there and growing, and if the content is real rather than keyword-stuffed, it is probably a legitimate change.
Always check the archive before and after the language change. If the new content looks real and the link profile shows new links in the new language, the change is probably legitimate. If the new content is obviously spam and the old English links are still the only authority, you are looking at a hack.
