A reputable domain does not guarantee that every page on it was published by the reputable owner.
Sometimes the page is there because somebody broke in.
Google’s current spam policies define hacked content as material placed on a site without permission because of a security vulnerability. The examples include code injection, injected pages, and other content added by attackers. See Google’s spam policies.
For search spam, the attraction is obvious.
A freshly registered junk domain may have no history, no links, and no reason for a search engine to trust it. A compromised university, small-business, nonprofit, government, or hobby site already has an established address and may have years of legitimate links pointing toward it.
An attacker can try to borrow that history.
The site owner may never have seen the page
Search-spam injections can be surprisingly separate from the visible website.
An attacker may create pages at obscure URLs, modify templates only for search crawlers, or insert links and redirects that ordinary visitors rarely encounter. The site’s homepage may continue looking normal while search results begin surfacing unrelated pharmaceuticals, gambling pages, fake stores, or other promotional material.
That distinction matters when evaluating responsibility.
The existence of a spam page under example.edu does not prove the university approved it. The domain tells you where the page is hosted, not who authorized the content.
Reputation becomes collateral
The legitimate owner pays several bills at once.
Visitors may encounter scams or malware. Search engines may reduce trust in affected pages. Administrators have to identify the compromise, remove injected material, patch the underlying weakness, request re-crawling, and sometimes repair years of reputational damage.
Meanwhile the spam operator can move on.
The attacker wanted the domain precisely because somebody else had already done the hard work of making it look legitimate.
This is one of the darker forms of industrialized search abuse because the infrastructure is stolen rather than merely purchased.
The Spam Empires lesson is simple:
a respected address can be borrowed without permission.
Trust the domain enough to investigate it.
Do not trust it enough to skip the investigation.