Hacked or penalized by G update?

[merick]

Hello!
One of my best domain had recently been hacked. Guy was inserting his own popunder code on my domain.
I reported him to ad company and they banned his account, and I found some r57 scripts on my domain and deleted them.

One day after that, around may 16., my SE traffic drop drastically from 90k to ~15k.
There is no manual action in search console.

Moz and other tools showed signs of big SE results fluctuations from may 16. but no one can tell what is update about.

Questions are as follows:
1. Is my domain still hacked and I'm not aware of it? (Some kind of redirection based on country or referrer)
2. Is there some thing of negative SEO or report to google that hacker filled in in order to kill my domain?
3. Is anyone aware of major google update from middle of may? (It is adult related site)

Thanks!

 

[Street Fighter]

I am not clearly known about that problem i think problem start from r57 scripts you found in your domain. same problem to my friend. if some know what is the main reason to decreasing traffic

 

[lorentzo]

r57 is not a web shell?

I suggest deleting all you have an reinstalling

 

[merick]

r57 is not a web shell?

I suggest deleting all you have an reinstalling

Yes, it is notorious shell, but deleting all is not an option.

 

[lorentzo]

I presume yu have backups from where it was clean...

 

[starki]

1. Is my domain still hacked and I'm not aware of it? (Some kind of redirection based on country or referrer)
2. Is there some thing of negative SEO or report to google that hacker filled in in order to kill my domain?
3. Is anyone aware of major google update from middle of may? (It is adult related site)

1. Possbile, really hard to tell without digging deeper.
2. No, if Google would have a problem with the site because of the hack, you'd have a message in SC and Google would show a warning in the SERPs. A penalty (manual action) based on a webspam report would also result in a message in the SC.
3. Nothing on a large scale, some unusual drops, but not as huge as yours and without any clear pattern. Since your site is adult related: In some countries porn is illegal without a proper ID based age verification and Google instantly removes results when the regulatory body reports them. Doesn't affect other country indexes, but depending where your traffic is coming from, this could have an impact.

 

[merick]

I presume yu have backups from where it was clean...

Yes, I have backups, I rolled one out, and now domain seems to be clean.

 

[merick]

1. Possbile, really hard to tell without digging deeper.

I have checked my template files, core class filles, database fields, .htaccess, apache and nginx settings, crontab on server...
Is someone can suggest something more to check?

 

[bartosimpsonio]

Yes, I have backups, I rolled one out, and now domain seems to be clean.

If you have access to search console, resubmit the root site and request a reindex of all linked pages. Unfortunately Google is now very slow to update the index so you'll need patience after removing the malware, weeks or even months in some cases.

 

[merick]

If you have access to search console, resubmit the root site and request a reindex of all linked pages. Unfortunately Google is now very slow to update the index so you'll need patience after removing the malware, weeks or even months in some cases.

Thanks bartosimpsonio, I have did that, I can't believe that G is that slow, If it was malware penalty, three weeks are passed and my keywords are disappearing every day from SERP.

 

[bartosimpsonio]

Thanks bartosimpsonio, I have did that, I can't believe that G is that slow, If it was malware penalty, three weeks are passed and my keywords are disappearing every day from SERP.

If you don't necessarily have to use this domain, you can register a new one and 301 the old site to it and use change of address on search console. If the old site isn't penalized this will work, and the new domain won't have the malware indexed. Other than that, all you can do is wait it out.

 

[Henry IV]

This question is akin to asking; "Good Sirs, my exposed common leg has recently been infected by a flesh eating virus. I believe I have removed the virus but an unknown issue persists, what is the issue?

I'm afraid you must share the URL so we can run a full analysis of the code itself. We also require GA logins to analyse the traffic change and ideally access to your hosting so we can check for any virulent files you have missed.