Thank you for writing about the Russian essay SEO spam scam. It really helped me understand what was happening with my site.
My website was one of those hacked, resulting in 40 pages of my search engine results being devoted to these crooks. And I can see from my Google Webmaster Tools that about 150 websites are now linked to non-existent academic paper writing-related pages on my site...so they were probably all hacked as well.
Clearly, the security I was using was not up to the task. My sites use both Joomla and Wordpress. Both were hacked. Anyway, I was curious who did it. It turns the attackers are from Russia and / or Ukraine. They redirect hacked pages to their essay mill site: apessay.com. I found they host the site on a Russian server behind a proxy:
Hosted Domains:
apessay.com
a24help.ru
a24-team.ru
edugram.com
Hostname: mail.a24-team.ru (redirected to Gmail)
IP: 193.70.1.15 (OVH and Cloudflare - the notorious hosts known for spam and hack attacks), also related to 85.17.225.+ (Leaseweb - another notorious cloud hosting service)
apessay.com was registered by a Russian domain registrar based in Moscow. It hides behind a Russian WHOIS proxy service.
They appear to be related to: edugram.com, bestwritingessay.com, essaypro.com, essayassist.com and essayservicereviews.com, also hosted on a Russian or cloud server. I also believe they work or are the same as speedypaper.com.
As the other poster mentioned apessay.com is typically the final destination. Users click on a hacked link and are redirected to the site. They block search engines from visiting the site.
If you host a website on a popular platform like Joomla or Wordpress make sure to keep them up to date. Uninstall all plugins you don't use. Install security plugins. Warn your friends from possible attacks. Share your experiences on social media and other helpful communities.
Merged:
Example of the malicious redirect to their Apessay siteHere is one example out of hundreds of thousands of websites hacked (or mass created) and redirected to their essay site. User clicks on a hacked link and is automatically redirected to their site. It records site data in the "rid" variable.

