1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hacked or penalized by G update?

Discussion in 'Black Hat SEO' started by merick, Jun 9, 2017.

  1. merick

    merick Newbie

    Joined:
    May 24, 2011
    Messages:
    5
    Likes Received:
    0
    Hello!
    One of my best domain had recently been hacked. Guy was inserting his own popunder code on my domain.
    I reported him to ad company and they banned his account, and I found some r57 scripts on my domain and deleted them.

    One day after that, around may 16., my SE traffic drop drastically from 90k to ~15k.
    There is no manual action in search console.

    Moz and other tools showed signs of big SE results fluctuations from may 16. but no one can tell what is update about.

    Questions are as follows:
    1. Is my domain still hacked and I'm not aware of it? (Some kind of redirection based on country or referrer)
    2. Is there some thing of negative SEO or report to google that hacker filled in in order to kill my domain?
    3. Is anyone aware of major google update from middle of may? (It is adult related site)

    Thanks!
     
  2. Street Fighter

    Street Fighter Jr. VIP Jr. VIP Premium Member

    Joined:
    Aug 4, 2015
    Messages:
    1,073
    Likes Received:
    228
    Gender:
    Male
    Occupation:
    Link Builder
    Location:
    In Street
    I am not clearly known about that problem i think problem start from r57 scripts you found in your domain. same problem to my friend. if some know what is the main reason to decreasing traffic
     
    • Thanks Thanks x 1
  3. lorentzo

    lorentzo Senior Member

    Joined:
    Nov 14, 2010
    Messages:
    808
    Likes Received:
    283
    Gender:
    Male
    r57 is not a web shell?

    I suggest deleting all you have an reinstalling
     
    • Thanks Thanks x 1
  4. merick

    merick Newbie

    Joined:
    May 24, 2011
    Messages:
    5
    Likes Received:
    0
    Yes, it is notorious shell, but deleting all is not an option.
     
  5. lorentzo

    lorentzo Senior Member

    Joined:
    Nov 14, 2010
    Messages:
    808
    Likes Received:
    283
    Gender:
    Male
    I presume yu have backups from where it was clean...
     
    • Thanks Thanks x 1
  6. starki

    starki Power Member

    Joined:
    Jul 17, 2012
    Messages:
    709
    Likes Received:
    233
    1. Possbile, really hard to tell without digging deeper.
    2. No, if Google would have a problem with the site because of the hack, you'd have a message in SC and Google would show a warning in the SERPs. A penalty (manual action) based on a webspam report would also result in a message in the SC.
    3. Nothing on a large scale, some unusual drops, but not as huge as yours and without any clear pattern. Since your site is adult related: In some countries porn is illegal without a proper ID based age verification and Google instantly removes results when the regulatory body reports them. Doesn't affect other country indexes, but depending where your traffic is coming from, this could have an impact.
     
    • Thanks Thanks x 1
  7. merick

    merick Newbie

    Joined:
    May 24, 2011
    Messages:
    5
    Likes Received:
    0
    Yes, I have backups, I rolled one out, and now domain seems to be clean.
     
  8. merick

    merick Newbie

    Joined:
    May 24, 2011
    Messages:
    5
    Likes Received:
    0
    I have checked my template files, core class filles, database fields, .htaccess, apache and nginx settings, crontab on server...
    Is someone can suggest something more to check?
     
  9. bartosimpsonio

    bartosimpsonio Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 21, 2013
    Messages:
    12,485
    Likes Received:
    11,184
    Occupation:
    CHEAP
    Location:
    DATASETS
    Home Page:
    If you have access to search console, resubmit the root site and request a reindex of all linked pages. Unfortunately Google is now very slow to update the index so you'll need patience after removing the malware, weeks or even months in some cases.
     
    • Thanks Thanks x 1
  10. merick

    merick Newbie

    Joined:
    May 24, 2011
    Messages:
    5
    Likes Received:
    0
    Thanks bartosimpsonio, I have did that, I can't believe that G is that slow, If it was malware penalty, three weeks are passed and my keywords are disappearing every day from SERP.
     
  11. bartosimpsonio

    bartosimpsonio Jr. VIP Jr. VIP Premium Member

    Joined:
    Mar 21, 2013
    Messages:
    12,485
    Likes Received:
    11,184
    Occupation:
    CHEAP
    Location:
    DATASETS
    Home Page:
    If you don't necessarily have to use this domain, you can register a new one and 301 the old site to it and use change of address on search console. If the old site isn't penalized this will work, and the new domain won't have the malware indexed. Other than that, all you can do is wait it out.
     
  12. Henry IV

    Henry IV Jr. VIP Jr. VIP

    Joined:
    Jan 21, 2014
    Messages:
    188
    Likes Received:
    75
    Occupation:
    King of England
    Location:
    UK
    This question is akin to asking; "Good Sirs, my exposed common leg has recently been infected by a flesh eating virus. I believe I have removed the virus but an unknown issue persists, what is the issue?

    I'm afraid you must share the URL so we can run a full analysis of the code itself. We also require GA logins to analyse the traffic change and ideally access to your hosting so we can check for any virulent files you have missed.