Strange!! Traffic from Google is being shown weird popups

rideronjourney

rideronjourney

Regular Member
Joined
Jul 3, 2016
Messages
256
Reaction score
86
Hello

I have this strange situation related to Google Traffic. When users search my website on Google and land on it, They see weird popups, but when users visit my website directly, they don't see any weird popups. It only happens with traffic from Google.

The Website is built on WordPress and I have scanned the website with Wordfence and there are no viruses/trojans etc.

Edit: I have checked the website on different browsers and devices. My friends from overseas have checked on their phones too and they are getting the same thing. (Added screenshots)


Can you guess what is happening?
 

Attachments

  • popup-1.png
    popup-1.png
    233.6 KB · Views: 75
  • popup-2.png
    popup-2.png
    215.5 KB · Views: 79
  • popup-3.png
    popup-3.png
    211.3 KB · Views: 77
  • popup-4.png
    popup-4.png
    206 KB · Views: 92
Last edited:
Advertise on BHW
what is website url?

check your site in another browser or another pc. May be your pc is infected
 
bachtoe said:
what is website url?

check your site in another browser or another pc. May be your pc is infected
Click to expand...

I did check on many different devices and browsers, Even my friends from overseas have checked on their phones too! same thing. Sorry Can't share the website URL.
 
rideronjourney said:
I did check on many different devices and browsers, Even my friends from overseas have checked on their phones too! same thing. Sorry Can't share the website URL.
Click to expand...
at least that popup screenshot work to identify issue
 
bachtoe said:
at least that popup screenshot work to identify issue
Click to expand...

I have added screenshots in the original post. It redirects through multiple URLs and finally, a page is shown up.
 
Website is hacked

Probably a plugin, turn them off one at a time until you see which one it is
 
DigitalGarden said:
are you using any nulled theme or plugin?
Click to expand...

Not using any active nulled plugin, In the past maybe I have added 1 nulled plugin to see the functionality and then later on I got it from their official website.
 
WordFence is glorified scanner that in useless in the most "attacks", searching php shells and base64 while malicious code is in javascript files and doesn't detect shit.
Manual check is required, theme and plugin javascript files. If nothing else, search for any http:// in js files and see if is legit.
 
paisawaisa said:
Either the website is hacked or pc is infected.
Click to expand...
it can't be the PC because people the world over are seeing the same thing, so it's definitely the site

To OP: try scanning it with Sucuri, see if they detect something
 
Last edited:
Check the wordfence logs and see if you find anything malacious attempts/logins/new admin user, etc. And keep a backup of healthy files/site.
 
tazarbm said:
it can't be the PC because people the world over are seeing the same thing, so it's definitely the site

To OP: try scanning it with Sucuri, see if they detect something
Click to expand...

I moved the website to a different server and deactivated all of the plugins, but still, the popups are showing up. Added sucuri and it shows everything is fine.

Reuploaded fresh WordPress files which also did not solve the issue.



PaulRD said:
Check the wordfence logs and see if you find anything malacious attempts/logins/new admin user, etc. And keep a backup of healthy files/site.
Click to expand...


Wordfence is showing that everything is perfect.
 
check phpmmyadmin and ensure site url is not tampered with. Also .htacess and wp-config and see any new redirect rule.
 
rideronjourney said:
I moved the website to a different server and deactivated all of the plugins, but still, the popups are showing up. Added sucuri and it shows everything is fine.

Reuploaded fresh WordPress files which also did not solve the issue.
Click to expand...
damn, I'm stumped then! The only thing I can think of is that a good hacker has hijacked your site's google position, in which case I don't know what to say. Sorry, amigo, this is out of my expertise. Maybe open up a thread in the HAF.. or in the Programming, or in the Cloaking sub-forums and ask there?
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top