Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors to less than 10 a day.

After doing some investigation, it turns out that sometimes when you load the website, the source shows only the following:

<html><body><script>document.cookie='sssssss=81b58aaasssssss_81b58aaa; path=/';window.location.href=parseURL(window.location.href);</script></body></html>

The cookie is different, for example on one of my computers it said something along the lines of zzzzzzz=something (can't remember the value) and on a proxy it showed the above value. If the cookie isn't set, it just won't load the website.

Now this obviously means that my website is somehow infected some sort of malware, however, Google doesn't return any search results. Does anyone recognise this malware or can offer some advise on how to find out what the problem is?

Note: the website is a custom written website and although I tried to make it as secure as possible, it obviously seems I might have missed something. Technology used is PHP5 and MySQL.

The URL is: http://ps3theme.net/

Thanks

EDIT: This only seems to happen the first time round. I did a mass search on the website and nothing was found. If you view the source before you load the website, it comes up, but once that piece of code has been executed, it doesn't come up anymore for a while.

share|improve this question
Link would be useful yes ;) – bybe♦ Jan 11 at 18:06
No worries, see updated answer. I wasn't sure if I was allowed to link it, is the reason I didn't! – Hosh Sadiq Jan 11 at 18:08
Just a heads-up. For me, opening your link in Chrome incognito shows your site just fine. This is with multiple tries, closing Chrome each time. – akTed Jan 25 at 20:03
You'd really need to make sure the JavaScript doesn't run. – Hosh Sadiq Jan 25 at 21:52

2 Answers

up vote 2 down vote accepted
+100

I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this:

$ curl -D - http://ps3theme.net/ -s
HTTP/1.0 200 OK
Expires: Sat, 6 May 1995 12:00:00 GMT
P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 144
Connection: Close

<html><body><script>document.cookie='rrrrrrr=a9bdb593rrrrrrr_a9bdb593; path=/';window.location.href=window.location.href;</script></body></html>

But one time I got this:

$ curl -D - http://ps3theme.net/ -s
HTTP/1.1 301 Moved Permanently
Date: Fri, 25 Jan 2013 19:42:15 GMT
Server: Apache
Location: http://www.ps3theme.net/406.shtml
Content-Length: 241
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.ps3theme.net/406.shtml">here</a>.</p>
</body></html>

There is no way that googlebot is going to be able to crawl your site when your server is responding like this.

Edit: I finally found the answer at this thread: http://productforums.google.com/forum/#!msg/webmasters/CCHRHVV_3fA/B_HQdIlzXkkJ

Your website is hosted at HOSTABLE.COM and they are the ones that are doing this to your site. It appears that you have to switch to a new host for this issue to go away.

share|improve this answer
Hi, thanks for the answer! I've already scanned all the files and nothing shows anything like it. Not really sure how and where to look next.. – Hosh Sadiq Jan 25 at 21:53
It would help to know what software powers your site. Make sure you carefully check the contents of any .htaccess file you have, many hijacks like this are inserted there (or the hijacker creates one if you didn't already have one.) – Stephen Ostermiller♦ Jan 25 at 22:22
Finally found something helpful. I edited my answer with new information. – Stephen Ostermiller♦ Jan 25 at 22:38
show 1 more comment
up vote 2 down vote

I've just taken a look at your site and the page seems to be rending my end without any obvious problems and naughty malwares. I've checked your source which looks clean, but you might be experiencing a HTACCESS injection which redirects people or least trys too. Take a look in the htaccess file.

Furthermore...

In your robots.txt you have

User-agent: *
Disallow: 
Disallow: /ajax.php
#Sitemap: http://www.yoursite.com/sitemap.xml

While the tag Disallow: with shouldn't block the bots it's something that isn't required and you should remove that line all together as well as the commented sitemap bit too from the robots.txt like so this becomes your new robots.

User-agent: *
Disallow: /ajax.php

Check your .htaccess file and let us know what you discover, is the site working for you? or is it just want webmaster tools is reporting?

share|improve this answer
Thanks for that! I'll update my robots.txt in a minute. The website "works". Sometimes it works, sometimes it doesn't. Namely when I clear my cookies (or use incognito), the first time it shows a blank page, and when I view the source, it shows the code in the question. Otherwise it shows the normal site. My .htaccess file is what it should be, so it's not that either. I've just downloaded the whole site (some 20GB), and I'm about to start a mass search the whole site! – Hosh Sadiq Jan 11 at 20:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.