Timeline for Suspicious php links found on cPanel visitors
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 12, 2021 at 9:10 | comment | added | Stephen Ostermiller♦ | You definitely had a hacked site. Once you have removed the malware and the pages return 404 status, Google will eventually crawl them and stop indexing them. See Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack? for some advice on getting Googlebot to come back and crawl those URLs so they can be removed more quickly. | |
| Sep 12, 2021 at 5:06 | comment | added | amrefayee | @MrWhite I finally manage to delete the folder using wordfence and some php files were detected as malware and i found some malware on db too. I manage to delete all the malwares and everything. But the unknown php pages are still indexed. I attached that index.php file with below link. we.tl/t-c2FSWa24fS | |
| Sep 12, 2021 at 4:57 | comment | added | amrefayee | @MrWhite These php pages are not existed in my site (both http and https). I force redirect my site to https after that only 301 showing on all the pages like above in http visitors. I know 301 is because of the http to https redirect that's not a problem, the problem is not existing pages (those php pages) are indexing still now i think its an seo spam or something. I found a folder on my public_html named shippingq with index.php file with alot of codes and a html page with my site header and footer with empty body. It's recreated if i delete that folder finally i manage to delete the folder | |
| Sep 10, 2021 at 13:05 | comment | added | MrWhite | @MohamedRefayee Are you saying that the 301 is simply a redirect from HTTP to HTTPS and the screenshot in the question shows HTTP requests, hence the redirect? And when you get a 404 page, is this the WordPress 404 page or something else? | |
| Sep 9, 2021 at 9:03 | comment | added | Stephen Ostermiller♦ | Hackers often configure the hacked site to only show the hacked content to bots and search engine visitors to make it hard to detect the hack. Just because you are clicking on the links and not seeing anything, it doesn't prove there is no hack. | |
| Sep 9, 2021 at 9:02 | comment | added | Stephen Ostermiller♦ | Do you have your ErrorHandler for 404 set up to be a redirect? | |
| Sep 9, 2021 at 5:52 | comment | added | amrefayee | Thank you.. I want to clarify that weird URLs are only showing on cPanel visitors, i have installed wordfence but it doesn't showing those URLs. And also when i click that 301 links it redirect me to 404 page. Just a week before i make force redirect my site to https, before that those URLs only showing on the http page visitors now it showing on both http and https visitors. | |
| Sep 8, 2021 at 14:49 | history | answered | Stephen Ostermiller♦ | CC BY-SA 4.0 |