Have I been "pharma" hacked?

bernard

bernard

BuSo Pro
Joined
Dec 31, 2016
Messages
2,600
Likes
2,305
Degree
6
I can't figure this out.

I see a bunch of links from "canadian pharma" links in Google Webmaster Tools, but when I go to these sites, then they are 404 and the sites seem broken.

I should mention, that my site has some pages about medicine.

When I google the supposedly backlink urls they seem to be indexed with content (generated descriptions), but there is no cache. When I visit they are all 404.

I know this is how the old "pharma hack" worked. With cloaking and stuff to hide the hacks from human visitors.

I just can't find any evidence of a hack on my site. What should I use to check for it? Could it be anything else than hack?
 
>What should I use to check for it?

Easiest way: User-Agent switcher extension is available for Chrome and Firefox. Set to Google's, and visit again.

What do you see?
 
builder said:
>What should I use to check for it?

Easiest way: User-Agent switcher extension is available for Chrome and Firefox. Set to Google's, and visit again.

What do you see?
Click to expand...

I've got some newb questions. Is there a particular Google bot user agent you should use, or will any one work? I'm guessing you have to add it as a custom user agent. What do you put in as the indicator flag? I tried making one below, no idea if this is correct though:
juuYlQK.png
 
The latest Googlebot user-agent is this:

Code: 
Mozilla/5.0 (compatible; Googlebot/2.1; +[URL]http://www.google.com/bot.html[/URL])

^^ Based off of last logs from Google IP addresses of my servers. So yeah @ryandiscord you got it right. The trick is to visit a place like https://www.ipchicken.com/ and see if they block you. If they block you, you are good to go cause they block fake googlebots.
 
Doesnt seem like the above works. IP Chicken blocks it.
 
ragnar said:
Doesnt seem like the above works. IP Chicken blocks it.
Click to expand...
You should re-read what I wrote, I stated that if IP CHICKEN BLOCKS YOU THEN YOU ARE GOOD TO GO.

BLOCK = GOOD
 
Thanks @CCarter and @builder! After doing a little more research on browsing as Google, I saw people mentioning using Google Translate (Spanish to English) on a page. Testing that out on IP Chicken does show a Google IP address. Not sure if there is any value to that in finding cloaked pages. I'm guessing that would only matter if they were particular enough to only show the page to Google IPs and Google user agents.
 
I had two of my sites hacked, no idea how. Only way I knew was checking with site:mydomain and it turned up with Canadian auto insurance and some crap about downloading torrents.

Still got no idea how since I don’t use loads of plugins/themes
 
real said:
Can you see the links in the SEPRs cache?
Click to expand...

He said there was no cache up, which is why they've got him trying to set up a fake googlebot user agent, in order to see what Google sees.

built said:
I had two of my sites hacked, no idea how. Only way I knew was checking with site:mydomain and it turned up with Canadian auto insurance and some crap about downloading torrents.

Still got no idea how since I don’t use loads of plugins/themes
Click to expand...

The use of one theme or one plugin can make you vulnerable. The use of zero themes or plugins can still leave you vulnerable at the server level. It's not always your fault. But it can be as simple as you leaving your permissions wrong on the wrong file or your server having some port open they shouldn't have, or your CMS allowing MySQL injections to reveal your login and password, or a non-sanitized input somewhere, etc. Those are the easy ways people get in.

ragnar said:
IP Chicken blocks it.
Click to expand...

Did you manage to see anything? Also, have you gotten on the trail of how this might be happening?

Check your Search Console account and see if your indexation spiked at any point. See if it stayed up and didn't drop back down. I see cases monthly where spammers create pages and then delete them (every time I maintain my disavow). It's not the same as your case though since these are off-site pages on other domains.
 
I didn't see anything strange using the Google user agent.

There are no indexed hacked pages in Google and Search Console tells me everything is a-ok.

I don't know if I have been hacked. I am quite perplexed about it. Why would anyone link to my site from 404 pages unless I was hacked, but those 404 pages don't even exist.

Could it be some kind of "referral spam"?

Used this tool: https://technicalseo.com/seo-tools/fetch-render/

Looks like it is cloaking, but doesn't look like hacking but scraping instead. My site shows up under "Lates news about xxx"

Strange..
 
Are you saying that the pages that are linking to your site are 404 with no cache, but are indexed... or is that the "new pages" on your own site.

Usually pharma hacks entail new pages being created on your domain that are then spammed. Is that the case with your site? If not, where did they aim the links?

Your post above makes it sound like they set up redirects to send googlebot to another page. Then again I'm having a hard time understanding what you're trying to say.
 
Edit: Ryu, two posts were merged, that's why the post above doesn't make sense.

There are no new pages on my site.

The pages are on other sites, but they are cloaked and only show to Google bot. They link to my (and other) sites by scraping serp results and presenting them as "Latest news".

Can't find any evidence of hack on my site now.
 
ragnar said:
Looks like it is cloaking, but doesn't look like hacking but scraping instead.

Strange..
Click to expand...

That's what it must be (scraping + cloaking), based on the information shared by you.

If you want, you can access your site using a Canadian IP (using something like TeleportYou or TunnelBear or paid proxy service or whatever you want to) and verify. If it looks different and you didn't do that, your site has been hacked.
 
You must log in or register to reply here.
Back