OT: Website protection

[schmero...@gmail.com]

One of our client's websites gets hacked frequently - 1x per month - 
usually with some kind of phishing scam.

I understand their first line of defense is to make sure security is 
tight and systems are up to date, however, it seems to me that there 
must be some scanning utility that would check their site for 
unauthorized pages via a search for domain names.

So, if our client was google, the utility would search all files on the 
site looking for domains. If it found microsoft.com within one of the 
pages and email would be sent to the administrator who could delete the 
page and look for other evidence of being hacked or add microsoft.com to 
the whitelist.

Any ideas where to look for such a beast &/or a mailing list that deals 
with this type of issue?