About 6 weeks ago my traffic stats jumped tremendously. I started noticing "top searches" for variations of porn words. In looking at my top landing pages in Google Analytics, it is showing landing page URLs ending in snippets such as "-cup-girl-porn-gif-xxx_e3ba94.html". There are over 1000 of them! Now Google webmaster is trying to crawl them and, of course are getting 404 errors. I have asked my hosting to check for malware on my server and they can't determine the cause. The increase in traffic is close to maxing out my server capacity (requiring me to upgrade). I was normally seeing daily traffic of around 150-200, but since this issue began, it is nearing 2000 daily. How do I get rid of these fake (and pornographic) URLs?
Asked
Active
Viewed 60 times
2
-
they aren't fake - they are real. Your site is hacked. – Evgeniy Dec 21 '18 at 15:21
-
I lean towards them being real. 2,000 page requests should be a piece of cake for any properly configured server even if they are coming in all within the same hour of the day, unless you have a very heavy site. It's more likely that you have some unwanted content sucking up all your bandwidth. – Maximillian Laumeister Dec 22 '18 at 01:55
-
@Evgeniy Is there somewhere to learn how to prevent this from happening, or how to stop it once it does? – elbrant Dec 24 '18 at 15:55
-
1@elbrant to stop it once it happened - delete everything in public web, install everything twice. Or: delete everything, upload a backup. To prevent it: learn about web security in general, server security, cms security, if in use. – Evgeniy Dec 25 '18 at 14:28
-
Google maintains a large resource for this: Help, I think I've been hacked! | Web Fundamentals | Google Developers – Stephen Ostermiller Mar 11 '19 at 10:55
1 Answers
1
Based on what you have put in your question it would appear most likely that your site has been infected with malware. There is a broad range of malware out there which will only show content to a restricted range of requests but not to others or to search engines. This most often happens from insecure file uploading to your site but this is by no means the only way that this happens. Best thing to do at this point is to shutdown the site, erase everything, and reinstall from backups. This will give you a hopefully clean implementation (if you have a backup of the site before infection), and beyond that it would be strongly recommended to do a security health check of your site and secure any infection vectors including file upload. You should also implement antivirus and malware scanning on your webserver with regular scans and a realtime scan of all uploaded files prior to saving them on your server to aid in protecting your site from future attacks.
Chris Rutherfurd
- 10,191
- 1
- 13
- 82