1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Strange baclklinks showing up...

Discussion in 'BlackHat Lounge' started by christianbed, Jul 27, 2015.

  1. christianbed

    christianbed Jr. VIP Jr. VIP

    Joined:
    Aug 17, 2011
    Messages:
    1,405
    Likes Received:
    919
    Location:
    alert("Make Money")
    Home Page:
    Last night I was looking at WMT and noticed one of my sites was ranking for a ton of porn-related keywords. Just to be clear, the site has nothing whatsoever to do with porn, so I'm not too happy about it despite the traffic bump because the site is now ranking for strange porn terms.

    I tracked down the urls, and they are all formatted like this:
    nameofmysite.com/software/random-longtail-porn-keyword.pdf
    When I click the link, it redirects instantly to a safedownload.ws site.

    There is no corresponding page on my site, so I have no idea how this person is indexing things using my domain name, then redirecting to this safedownload site. I've scanned it with Sucuri, but it comes up with nothing.

    And no, just switching it over to a porn-related site isn't an option...this site is part of a long-standing consulting business, with a legit client base that pays a monthly fee for services.

    Has anyone experienced this?
     
  2. Apricot

    Apricot Administrator Staff Member Moderator

    Joined:
    Mar 26, 2013
    Messages:
    13,490
    Likes Received:
    8,441
    Gender:
    Female
    Occupation:
    BHW Admin
    Location:
    Station 2E
    Home Page:
    is it a wordpress site?
     
  3. veboo

    veboo Jr. VIP Jr. VIP

    Joined:
    Aug 22, 2014
    Messages:
    1,152
    Likes Received:
    701
    It seems someone has hacked your site and using your site in redirects to use as pumpers of their own.
     
  4. christianbed

    christianbed Jr. VIP Jr. VIP

    Joined:
    Aug 17, 2011
    Messages:
    1,405
    Likes Received:
    919
    Location:
    alert("Make Money")
    Home Page:
    Yep, WP site.............
     
  5. Apricot

    Apricot Administrator Staff Member Moderator

    Joined:
    Mar 26, 2013
    Messages:
    13,490
    Likes Received:
    8,441
    Gender:
    Female
    Occupation:
    BHW Admin
    Location:
    Station 2E
    Home Page:
    Sounds like the pharma hack - look for files in the root titled things like auto.php or keyboard.php. Basically, check the Wordpress codex for the list of files that should be in the root directory and see what shouldn't be there. You'll need to delete these & reinstall Wordpress as the hack changes core files. Backup etc etc - if you search the codex for Pharma hack, you'll find step by step instructions on how to clean. Afterwards, make sure you harden your install properly. It's not complicated just a bit of a pain. Good luck!
     
    • Thanks Thanks x 1
  6. KunkkaSword

    KunkkaSword Newbie

    Joined:
    Apr 10, 2013
    Messages:
    41
    Likes Received:
    10
    Location:
    United States
    Try Wordfence to clean it up.
     
    • Thanks Thanks x 1
  7. christianbed

    christianbed Jr. VIP Jr. VIP

    Joined:
    Aug 17, 2011
    Messages:
    1,405
    Likes Received:
    919
    Location:
    alert("Make Money")
    Home Page:
    Thanks for the help lads, much appreciated!