The site is down. Blank page, HTTP 200, no PHP error in the logs. Nothing to grab onto.
Googlebot, meanwhile, gets full pages. Links to counterfeit shops, indexed for three days under the client's name. The site is dead for humans and very much alive for crawlers. That is the worst case: nobody sees the content dirtying the domain, and the domain gets dirty anyway.
The antivirus has just finished its sweep. 373 files scanned, zero detections.
It took three days to untangle: where they came in, what they left behind, and what had to change so none of them could do it again. The client, the domain and the addresses are anonymised. The rest is exact, including the times I chased the wrong lead. Those are usually the useful parts.
The blank page was not the problem
