Forum Moderators: open

Message Too Old, No Replies

Text for casinos, dating in my cached pages, harmful, how?

Text that I never put on my site is on my cached pages, very harmful

         

mkaresh

4:43 pm on Sep 26, 2009 (gmt 0)

10+ Year Member



About a week ago < my website > started getting irrelevant ads from Adsense and my organic search traffic started a rapid decline--it's now half what it was.

Investigating, I found that many of my cached pages on Google and Bing had text about casinos, gay dating, or sex with Ukranian women, such that the search engines thought this was their topic.

To replicate, search "[my site name] casino" "[my site name] dating" or "[my site name] sex".

The text in question appears on many other sites, usually for colleges or non-profits.

This text can be seen by viewing the source code of the cached pages.

This text is not showing up on my pages currently. But I'd like to know how it happened, and how to get it out of Google's cache.

[edited by: tedster at 6:53 pm (utc) on Sep. 26, 2009]
[edit reason] no personal urls, please. [/edit]

mattur

5:43 pm on Sep 26, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Your website has been hacked, and your pages have been altered to include this text - possibly only for Googlebot.

See How Hacked Servers Can Hurt Your Traffic [webmasterworld.com]

mkaresh

6:50 pm on Sep 26, 2009 (gmt 0)

10+ Year Member



Thank you for that link.

I'm looking, and still not finding where I've been hacked. Whatever was done does only show up in the search engine caches. The location of the foreign text indicates it should be in my header file, but there's nothing in that file that shouldn't be.

I suspect that, if there is some illicit code on my site, that it came in through Wordpress, and from there somehow made it to the non-Wordpress part of the site.

A search of the phrase in question finds thousands of similarly affected sites, but nearly all of them are colleges or non-profits. None have been strictly commercial sites.

jdMorgan

7:04 pm on Sep 26, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Use a user-agent spoofing tool such as WannaBrowser to request one of these pages from your site while posing as a legitimate Googlebot (copy a valid Googlebot user-agent string from your raw server access log file for use with this tool).

As detailed in the cited thread, it's likely that your site was hacked, and is returning these modified pages *only* when they are requested by a search engine robot. Also as detailed in that thread, a common mechanism is a hacked .htaccess file (if you're hosted on an Apache server).

Start digging to find the cause, as this did not happen 'by magic' and if you have not found the reason, then the problem still exists and will continue to do more and more damage to your rankings...

Jim

mkaresh

7:34 pm on Sep 26, 2009 (gmt 0)

10+ Year Member



Thanks. Did that an hour or so ago, and as you suspect the text IS still on the pages when viewing them as Googlebot.

I'm also finding that this hack links affected sites together by placing the affected URLs for one site on another affected site, and so on. I found such URLs for another site on my site, and my site's affected URL--using an illegitimate wp-link.php file--on a third site.

mkaresh

7:39 pm on Sep 26, 2009 (gmt 0)

10+ Year Member



Should have checked the .htaccess file earlier. Totally hacked.