1

There is an HTTP website (not HTTPS) that works perfectly fine when the URL is directly typed into the address bar or when links are clicked from other websites/applications like Reddit, Facebook, and Discord.

The exceptions are the major search engines: Google, Yahoo, and Bing. When clicked from one of these sites, it is redirected to a scammy pharmacy site with one of many different domain names. This occurs in Chrome, Firefox, and Edge; it also occurs on Android smartphones. (Bing only does this in Chrome; it works fine in Firefox and Edge.) This issue occurs for multiple people on many different devices.

Interestingly, other search engines (Dogpile, Baidu, Ask, DuckDuckGo, Yandex, etc.) seem to work fine.

What could be the cause of this behavior? Do the search engines or the website need to be fixed, and how? Would converting to HTTPS help, and why?

The website in question is bluefurok.com. I am not the webmaster, but as a programmer and web developer I am curious about this issue.

3

Your website has been hacked. The hacker added some code to do the redirect only if it detects a referrer from a search engine. The search engines are not the problem here. Your site is what needs to be fixed.

Redirecting only search engine traffic is a common technique for hackers. They do this because it takes the majority of your traffic while making many hacked webmasters unaware of the problem. They may also be adding pharmacy content to your website that gets ranked by the search engines.

To implement the hack, the hacker may have:

  • Inserted code into your .htaccess file to do the redirect.
  • Created cron jobs that will re-create the hack one you clean it up
  • Opened other backdoors to your website by uploading scripts or hacking existing scripts
  • Infected your content management system (CMS) and database.

The best place to learn how to deal with the problem is with Google's guide for fixing hacked websites. If you are running WordPress, this type of hack is extremely common. There are guides specifically for cleaning up this type of hack from within WordPress.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.