You're thinking about it the right way at least. Many clients come to me with "get rid of that bad listing right now!!!" and I have to respond with "I'm sorry but if I controlled the internet I wouldn't be working for you" and then they storm out and it's generally a bad scene.

All those things you mentioned are good tactics to push something down the SERP. Some others off the top of my head:

• Press Releases
• Guest Blog/Friend Blogs about the company
• Bizarrely, YouTube works sometimes if the account is co-branded
• Registering for services like Manta, TechVibes, citdirectory, macrae's, other industry directories
• Legitimate forum postings made in the company's name

There's others, but I think you get the idea.

Speaking personally I'm not in favor of it but more from an appearance perspective. I've seen a lot of cases where this is abused by smaller operations who aren't taking their customer's overall outbound link profiles into account. We've inherited projects where the previous designer put about 100 words into the META author tag spamming his keywords, and then in addition put at least a paragraph of ALT text on his footer link. The client didn't even know it was there, or what it necessarily meant.

I also think it detracts from the appearance/professionalism of larger clients sites. I think personally I'm moving towards either very subtle and small center-footer links, with the full knowledge of the client, or a paragraph and link on the About US/Partners page. Note this is my opinion on what we're doing and not meant as an indictment of anyone else's practices.

If you're going custom then I agree with Highland, phpBB is pretty okay; it's not as knock your socks off as some of the paid solutions, but what's nice is there's lots of example code out there. Forum software is generally so abstracted that it doesn't matter if there are lots of topics or not, since you can create sub-boards for each major topic. This wikipedia link has a good write up of feature-sets, and then near the bottom are links to comparison articles for PHP and ASP based forums:

http://en.wikipedia.org/wiki/Comparison_of_Internet_forum_software

Another thing to watch out for is see if someone is trying to snake your design/business model. I know in the past when I would get suspicious traffic like that I would quickly take a spin around elance/odesk/etc. and often find a competitor had posted something like 'make me a site just like (mysite.com) but cheap and scrape all their products so they're already in a database'.

If Bangladesh is nowhere near your customer base I'd do what Ryan suggests as well and block em.

I agree with EGOL; for a few years it seemed that 'microsites' were the way to go, especially in regards to B2C sales. You would have operations like CSN Stores and Net Shops all with hundreds, if not thousands of bizarrely specific domains (e.g. I believe Net Shops had something like LeatherCounterHeightBarstools.com or the like). But now, they've mostly stopped doing that.

In part, it's because they realized that having an individual brand was far better than hundreds of tiny sub-brands (they became WayFair.com and HayNeedle.com respectively). But it was also because having multiple domains increased the headache of maintenance, introduced duplicate content problems, and simply added costs. And lastly, just as EGOL says, once they 301's all those little domains back to their main one, they got tons of link juice and relevance.

In my opinion there isn't really any downside to this from a Google perspective; as you said, they shouldn't even be indexed anyway. Many many vendors out there have their charge/fulfillment go straight to PayPal for example, and don't even host any checkout specific code (other than cart-building, account creation, etc.) on their site at all.

There's also the case where multiple microsites will all use the same checkout on another domain, used to centralize checkouts. As far as I know these sites aren't punished either, and it definitely saves money on the secure certificates.

There is however, another angle to consider, and that is the human angle. Some people (who aren't savvy about ecommerce) might be alarmed that their secure checkout is occurring on a different domain than the one they've been browsing on. This is a 'security/conversaion' rate issue though, so you may already know of it.

In my opinion I would leave it alone and not bother with the iframe tricks and so on. A subdomain might be more reassuring to the user (e.g. secure.printingofrless.com instead printingforless1.com) but I honestly can't see why the current setup would have Google implications, as long as your SSL/non-SSL pages are separate and canonicalized properly.

To add on what Lonnie said, the way things are now is that the human perception of domain names is almost more important than Google's. However, I'm assuming that you're referring to backlinks, and not actual domain names (since you already have a highly ranked .com domain name). In the past .edu links were considered more important, but personally I believe that Google is no longer weighing them heavier due to abuse of .edu links. I think that (theoretically) Google is more satisfied with the Panda update and how that interprets textual content for domain strength as opposed to what three letter suffix the domain ends in.

Apologies if I misunderstood your question, and you were considering going with a .org/.net/etc domain for your site.