1. A method for detecting a search engine optimization (SEO) attack, the method comprising: identifying a plurality of suspicious websites from among a plurality of websites; extracting a set of lexical features for each website among from the plurality of suspicious websites; clustering each website from among the plurality of suspicious websites into a plurality of groups based on the set of lexical features extracted for each website; and performing group analysis on each group from among the plurality of groups to identify at least one suspicious group.