1. A method comprising: identifying a plurality of suspicious websites from among a plurality of websites; extracting a set of lexical features for each website among from the plurality of suspicious websites; clustering each website from among the plurality of suspicious websites into a plurality of groups based on the set of lexical features extracted for each website; performing group analysis on each group from among the plurality of groups to identify at least one suspicious group that provides confirmation of at least one search engine optimization (SEO) attack; and using the identified at least one suspicious group to identify a corresponding group of compromised servers targeted by the SEO attack, wherein the corresponding group of compromised servers comprises a subset of servers that exhibit a change in behavior, indicative of the SEO attack.