1. This website uses cookies to improve service and provide a tailored user experience. By using this site, you agree to this use. See our Cookie Policy.
    Dismiss Notice

Honestly, tired of this hacker shit.

Discussion in 'Black Hat SEO' started by soa0611, Sep 14, 2019.

  1. soa0611

    soa0611 Elite Member

    Joined:
    Apr 20, 2015
    Messages:
    1,999
    Likes Received:
    1,139
    Occupation:
    Listening to house music
    Location:
    Europe
    Some japanese dickhead hacked my site in the beginning of August.
    We cleaned up all the files on the VPS - erased and set up the backup WP version with the previous clean code.


    I 404-ed and then removed all these Japanese spam pages in GMT.


    But on daily basis i am facing 1-2 new spam pages in Google index.

    How the fuck is he doing this shit?
     
  2. blazingprofits

    blazingprofits Junior Member

    Joined:
    Jan 7, 2010
    Messages:
    192
    Likes Received:
    147
    install wordfence, see if it detects any backdoor that already exists
     
    • Thanks Thanks x 1
  3. MountainGuy

    MountainGuy Power Member

    Joined:
    Jul 9, 2019
    Messages:
    608
    Likes Received:
    400
    Gender:
    Male
    Occupation:
    ↓ USA-Native Author↓
    Location:
    ↓ Money-site Quality↓
    Home Page:
    I thought about getting into hacking when my site was cleaned.

    I paid wordfence to clean mine and I had the same issue where after it was all cleaned those pages would still keep popping up.

    I forgot the wording but they gave me what seemed like a bull shit answer... They said even though site was clean that would happen for a couple months... Which it did... And then it stopped...

    In my case i gave up cleaning the pages and in a couple months when I checked back it was all clean.

    It was impressive how well he bent me over once he was in my system
     
    • Thanks Thanks x 2
  4. LuckyCharm007

    LuckyCharm007 Elite Member

    Joined:
    Jul 8, 2015
    Messages:
    2,178
    Likes Received:
    1,487
    Occupation:
    Retired
    Stop downloading hacked themes. That’s what you get for being cheap.
     
    • Thanks Thanks x 6
  5. soa0611

    soa0611 Elite Member

    Joined:
    Apr 20, 2015
    Messages:
    1,999
    Likes Received:
    1,139
    Occupation:
    Listening to house music
    Location:
    Europe
    only unusual .php file in wpadmin, i deleted it

    official Generate Theme
     
  6. Dimaz

    Dimaz Newbie

    Joined:
    Apr 26, 2019
    Messages:
    4
    Likes Received:
    1
    Gender:
    Male
    what about GPL theme?
     
  7. Geasy

    Geasy Jr. VIP Jr. VIP

    Joined:
    Jul 26, 2016
    Messages:
    1,956
    Likes Received:
    2,370
    What kind of hosting are you using? The hosting I am, doesn't allow the site to run if it has any virus at all. They send me the files with malwares, and I have to fix them. Maybe your hosting company can do the same for you.
     
    • Thanks Thanks x 1
  8. soa0611

    soa0611 Elite Member

    Joined:
    Apr 20, 2015
    Messages:
    1,999
    Likes Received:
    1,139
    Occupation:
    Listening to house music
    Location:
    Europe
    it is FastVPS
    Interesting thing that they found out the malicious code, fixed it, but spam pages keep popping up after all these moves
     
  9. se900se

    se900se Jr. VIP Jr. VIP

    Joined:
    Oct 14, 2014
    Messages:
    5,051
    Likes Received:
    2,804
    Gender:
    Male
    Occupation:
    Traffic Arbitrage
    Location:
    New York
    Home Page:
    What hosting are you using?
     
  10. Geasy

    Geasy Jr. VIP Jr. VIP

    Joined:
    Jul 26, 2016
    Messages:
    1,956
    Likes Received:
    2,370
    They most likely have a backdoor or something that keeps infecting your site

    smarthosting.co.uk -
     
  11. tubeboost

    tubeboost Jr. VIP Jr. VIP

    Joined:
    Sep 24, 2014
    Messages:
    1,275
    Likes Received:
    354
    Location:
    The Internet
    Home Page:
    It's obviously via backdoors. Look at logs.
     
  12. ikenna Adigwe

    ikenna Adigwe Jr. VIP Jr. VIP

    Joined:
    Feb 18, 2019
    Messages:
    100
    Likes Received:
    18
    Most likely hacking you due to a cracked theme plugin i believe
     
  13. BigGSeo

    BigGSeo Junior Member

    Joined:
    Mar 5, 2018
    Messages:
    124
    Likes Received:
    36
    It will get indexed in google in future because the pages already crawled, I have gone through this , my site was hacked and 6000 pages was indexed and I delete all next day of hacking , it has been 8 month, still 800 pages on search console. Use site:yourwebsite.com if you find nothing except your site content then your site is clean. Do not worry about hacked pages in search console it will be removed by time. Not sure how you clean your site, make sure no null plugins, no backdated plugins or themes and fresh installation of wordpress and you have to check database as well if new table created except your wp table
    . And finally you have to change cpanel otherwise it will be hacked again. Thank you.
     
    • Thanks Thanks x 3
    Last edited: Sep 14, 2019
  14. se900se

    se900se Jr. VIP Jr. VIP

    Joined:
    Oct 14, 2014
    Messages:
    5,051
    Likes Received:
    2,804
    Gender:
    Male
    Occupation:
    Traffic Arbitrage
    Location:
    New York
    Home Page:
    Re-index site in Search Console, submit a list of no-index URLs, check if the sitemap got affected as well.
     
    • Thanks Thanks x 1
  15. LuckyCharm007

    LuckyCharm007 Elite Member

    Joined:
    Jul 8, 2015
    Messages:
    2,178
    Likes Received:
    1,487
    Occupation:
    Retired
    Now that’s weird. They probably left a backdoor somewhere that you haven’t found yet.
     
  16. flundererboy

    flundererboy BANNED BANNED

    Joined:
    Nov 10, 2015
    Messages:
    127
    Likes Received:
    12
    Gender:
    Male
    If you make weekly backup of you site then you should upload backup before hacking. it will fix all of your problems.
     
    • Thanks Thanks x 1
  17. darksador

    darksador Newbie

    Joined:
    Jun 19, 2010
    Messages:
    31
    Likes Received:
    8
    totally seems its security hole in your vps probably in something like apache or something thats is setted up with noname what is the os you are using ?

    always update your program
    dont open unknown e-mail
    scan your own computer for virus keylogger etc
    stop downloading torrent if you download any torrent
    dont use nulled script etc on your wordpress

    and its only the basic of computer security if you dont know computer security enough just buy a normal hosting instead of using vps or hire someone for security (cost a lot to hire someone)
     
    • Thanks Thanks x 1
  18. zilog357

    zilog357 Regular Member

    Joined:
    Nov 27, 2008
    Messages:
    397
    Likes Received:
    675
    Gender:
    Male
    Location:
    USA
    Not sure about your case and I don't know what you mean by "spam pages in Google index", but once a backdoor fires up, there could be copies anywhere. Do you see this on your computer only? Have you tried from another PC? Also, if using a CDN, like Cloudflare, there might be an "old" version of the site running around. In that case, you would need to erase the CDN cache too. Once you erase it, the CDN will take a few minutes or hours to clean itself.

    I shared a WP admin theme here with a cool design and changes to my admin were not showing up. I cleared cookies, cache, everything, and still, the old Admin design showed up. It was like if the server was not accepting the new files being uploaded. Until I purged my CDN cache.
     
    • Thanks Thanks x 1
  19. wiaderny01

    wiaderny01 Registered Member

    Joined:
    Mar 3, 2015
    Messages:
    84
    Likes Received:
    42
    My site was infected with japanese keyword hack back in June, then I followed all the steps to remove it, removed all the nulled scripts and themes, scanned my website and database, contacted my hosting company to check if the site is virus-free now. They said that everything is okay. Still, after almost 2 months after searching for site:mysitename.com some japanese shit is still showing in search results and as you said, more infected pages are showing everyday. BUT just after I "removed" the hack from my site, my rankings went back to normal and they're ok to this day. When i search for a random keyword that my site is ranking for, then it shows normal results as it should. The japanese words show only when i search my whole site:sitename.com. So, I guess it's like @BigGSeo said. No worries.
     
    • Thanks Thanks x 2
  20. Martin Cathy

    Martin Cathy Registered Member

    Joined:
    Apr 13, 2019
    Messages:
    98
    Likes Received:
    12
    Gender:
    Male
    I think you were tracked. Better to change all you can change.