Malicious links to our site on Google's SERP redirecting to shady pages

Question

Our website is being attacked in a curious way: on the Search Results Page, Google is showing links that look as if they were to pages on our site but they direct to some shady viagra-selling sites.

I've done some research and found no trace of those pages on our website (Nginx + Wordpress).

I tried to curl some of those links curl -X HEADER -i www.oursite.com/pilule-de-viagra/and got those results :

HTTP/1.1 302 moved Temporarily
Date: Tue, 02 Feb 2016 13:46:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
X-Pingback: http://www.oursite.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Location: http://www.oursite.com
Vary: Accept-Encoding
X-Powered-By: PleskLin
MS-Author-Via: DAV
Server: shield
Via: 1.1 google

What kind of attacks is this, i.e. is this some malicious code injected in our server or is it some black-hat SEO hack that operates without having access our servers?

And most importantly, how to deal with this stuff?

Answer 1

Your site is hacked. Somebody likely installed software on your site that is doing the redirects. It is probably also showing some content only to Googlebot. You need to clean up your hacked website.

Google has an entire webmaster help section dedicated to hacked sites: https://www.google.com/webmasters/hacked/