Strange!! Traffic from Google is being shown weird popups

[rideronjourney]

Hello

I have this strange situation related to Google Traffic. When users search my website on Google and land on it, They see weird popups, but when users visit my website directly, they don't see any weird popups. It only happens with traffic from Google.

The Website is built on WordPress and I have scanned the website with Wordfence and there are no viruses/trojans etc.

Edit: I have checked the website on different browsers and devices. My friends from overseas have checked on their phones too and they are getting the same thing. (Added screenshots)


Can you guess what is happening?

 

[Deleted member 807298]

what is website url?

check your site in another browser or another pc. May be your pc is infected

 

[rideronjourney]

what is website url?

check your site in another browser or another pc. May be your pc is infected

I did check on many different devices and browsers, Even my friends from overseas have checked on their phones too! same thing. Sorry Can't share the website URL.

 

[Deleted member 807298]

I did check on many different devices and browsers, Even my friends from overseas have checked on their phones too! same thing. Sorry Can't share the website URL.

at least that popup screenshot work to identify issue

 

[rideronjourney]

at least that popup screenshot work to identify issue

I have added screenshots in the original post. It redirects through multiple URLs and finally, a page is shown up.

 

[Deleted member 807298]

your website is infected.

 

[daverawcus]

Website is hacked

Probably a plugin, turn them off one at a time until you see which one it is

 

[rideronjourney]

your website is infected.

ohh I tried scanning with WordFence but it did not show anything suspicious.

Website is hacked

Probably a plugin, turn them off one at a time until you see which one it is

Yes, I am doing that now... thanks for your suggestion

 

[DigitalGarden]

ohh I tried scanning with WordFence but it did not show anything suspicious.


Yes, I am doing that now... thanks for your suggestion

are you using any nulled theme or plugin?

 

[rideronjourney]

are you using any nulled theme or plugin?

Not using any active nulled plugin, In the past maybe I have added 1 nulled plugin to see the functionality and then later on I got it from their official website.

 

[Deleted member 807298]

https://www.wordfence.com/learn/removing-malicious-redirects-site/

 

[paisawaisa]

Either the website is hacked or pc is infected.

 

[TZ2011]

WordFence is glorified scanner that in useless in the most "attacks", searching php shells and base64 while malicious code is in javascript files and doesn't detect shit.
Manual check is required, theme and plugin javascript files. If nothing else, search for any http:// in js files and see if is legit.

 

[tazarbm]

Either the website is hacked or pc is infected.

it can't be the PC because people the world over are seeing the same thing, so it's definitely the site

To OP: try scanning it with Sucuri, see if they detect something

 

[PaulRD]

Check the wordfence logs and see if you find anything malacious attempts/logins/new admin user, etc. And keep a backup of healthy files/site.

 

[rideronjourney]

it can't be the PC because people the world over are seeing the same thing, so it's definitely the site

To OP: try scanning it with Sucuri, see if they detect something

I moved the website to a different server and deactivated all of the plugins, but still, the popups are showing up. Added sucuri and it shows everything is fine.

Reuploaded fresh WordPress files which also did not solve the issue.

Check the wordfence logs and see if you find anything malacious attempts/logins/new admin user, etc. And keep a backup of healthy files/site.

Wordfence is showing that everything is perfect.

 

[PaulRD]

check phpmmyadmin and ensure site url is not tampered with. Also .htacess and wp-config and see any new redirect rule.

 

[tazarbm]

I moved the website to a different server and deactivated all of the plugins, but still, the popups are showing up. Added sucuri and it shows everything is fine.

Reuploaded fresh WordPress files which also did not solve the issue.

damn, I'm stumped then! The only thing I can think of is that a good hacker has hijacked your site's google position, in which case I don't know what to say. Sorry, amigo, this is out of my expertise. Maybe open up a thread in the HAF.. or in the Programming, or in the Cloaking sub-forums and ask there?