Strange Variations of URL Showing Up in Google Search Console

Question

My wife and I started a website several months ago. Today on Google Search Console we noticed some strange variations of pages on her site. They were found under the section:

Coverage > Crawled - currently not indexed

They look something like the following with our domain and some weird words appended to the end:

example.com/detroitchicago/raleighz.js?gcb=195-0&cb=5

example.com/porpoiseant/jellyfish.webp?a=a&cb=0&shcb=34

example.com/detroitchicago/edmonton.webp?a=a&cb=0&shcb=34

example.com/detroitchicago/memphis.js?gcb=195-0&cb=10

example.com/detroitchicago/minneapolis.js?gcb=195-0&cb=3

These pages just load up a bunch of gibberish code.

When I go to the referring pages and do a find, I don't see any mention. However, if I do an inspect in my Chrome browser and search for string "detroitchicago" then a handful of results show up.

Was the website hacked? I don't see any directories like detroitchicago in my hosting file manager when I search for it, but it seems to be in the page code.

What can I do to fix this problem and prevent it from happening? Do I just submit a new request to remove these strange URLS in Google Search Console?

Answer 1

I don't think your website was hacked. I think you're using Ezoic CDN integration, and these extra javascript pieces are being injected by Ezoic for ad-serving purposes.

I just noticed this myself, and I can tell my server is serving 404s for those requests, but the Ezoic CDN is injecting them.

If you are able to check your host's access logs, do so and you will probably see that the same requests are 404 at your end.

Answer 2

Was the website hacked?

Most certainly so. Anyway there is probably no good reason to take time to assess so and how much, as soon as you find content that shouldn't be there (as you say if I understand right that the pages do return content, what you call gibberish is Javascript code which, like any tool, could be used for good and bad reasons, it can be there as well for analytics for example as a quick view on it might conclude, but then the console shows various resources are tried all over the place including external to your website with only errors, which is more a sign of a malware of some sort than some clean analytics system), there is only one sane and safe option: re-install your website completely from scratch from some known sane backup of it (you do have backups?)

Do not attempt to "clean" things by looking at each existing file one by one because you can miss a lot of things that way

If you can, you should shut it down immediately, and then clean it. Otherwise it may be currently being used in some attacks.

What can I do to fix this problem and prevent it from happening?

This is difficult to reply in general, you should consult your current webhosting company and discuss this with them. It typically means increasing security, which also starts on your end, by changing any password you have to access the site in "admin" mode (like credentials to do FTP uploads, or credentials to open the hosting company panel, etc.) to make sure it is both good, unique and never stored in plain text.

It also depends how your website is constructed. If you used a CMS like Wordpress you can be hacked through plugins you installed, so you have to review all of that.

Some companies can sell you services to either clean your current site and/or review its security to defend against further attacks. It is probably difficult to guarantee any efficiency here.

Do I just submit a new request to remove these strange URLS in Google Search Console?

Maybe, but if you don't clean your website the problem will re-appear. If Google knows about those URLs it is because they appear "somewhere", there is some content linking to them, as it typically happens with any malware that hosts content all over the place (aka: in multiple websites to combat detection)