I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors to less than 10 a day.

After doing some investigation, it turns out that sometimes when you load the website, the source shows only the following:

<html><body><script>document.cookie='sssssss=81b58aaasssssss_81b58aaa; path=/';window.location.href=parseURL(window.location.href);</script></body></html>

The cookie is different, for example on one of my computers it said something along the lines of zzzzzzz=something (can't remember the value) and on a proxy it showed the above value. If the cookie isn't set, it just won't load the website.

Now this obviously means that my website is somehow infected some sort of malware, however, Google doesn't return any search results. Does anyone recognise this malware or can offer some advise on how to find out what the problem is?

Note: the website is a custom written website and although I tried to make it as secure as possible, it obviously seems I might have missed something. Technology used is PHP5 and MySQL.

The URL is: http://ps3theme.net/


EDIT: This only seems to happen the first time round. I did a mass search on the website and nothing was found. If you view the source before you load the website, it comes up, but once that piece of code has been executed, it doesn't come up anymore for a while.

  • Link would be useful yes ;) Jan 11, 2013 at 18:06
  • No worries, see updated answer. I wasn't sure if I was allowed to link it, is the reason I didn't!
    – Hosh Sadiq
    Jan 11, 2013 at 18:08
  • Just a heads-up. For me, opening your link in Chrome incognito shows your site just fine. This is with multiple tries, closing Chrome each time.
    – akTed
    Jan 25, 2013 at 20:03
  • You'd really need to make sure the JavaScript doesn't run.
    – Hosh Sadiq
    Jan 25, 2013 at 21:52

2 Answers 2


I can confirm that there is some malware or misconfiguration interfering with your site. I'm using the command line client called curl. When I make a request with curl, I get something like this:

$ curl -D - http://ps3theme.net/ -s
HTTP/1.0 200 OK
Expires: Sat, 6 May 1995 12:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 144
Connection: Close

<html><body><script>document.cookie='rrrrrrr=a9bdb593rrrrrrr_a9bdb593; path=/';window.location.href=window.location.href;</script></body></html>

But one time I got this:

$ curl -D - http://ps3theme.net/ -s
HTTP/1.1 301 Moved Permanently
Date: Fri, 25 Jan 2013 19:42:15 GMT
Server: Apache
Location: http://www.ps3theme.net/406.shtml
Content-Length: 241
Connection: close
Content-Type: text/html; charset=iso-8859-1

<title>301 Moved Permanently</title>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.ps3theme.net/406.shtml">here</a>.</p>

There is no way that googlebot is going to be able to crawl your site when your server is responding like this.

Edit: I finally found the answer at this thread: http://productforums.google.com/forum/#!msg/webmasters/CCHRHVV_3fA/B_HQdIlzXkkJ

Your website is hosted at HOSTABLE.COM and they are the ones that are doing this to your site. It appears that you have to switch to a new host for this issue to go away.


I've just taken a look at your site and the page seems to be rending my end without any obvious problems and naughty malwares. I've checked your source which looks clean, but you might be experiencing a HTACCESS injection which redirects people or least trys too. Take a look in the htaccess file.


In your robots.txt you have

User-agent: *
Disallow: /ajax.php
#Sitemap: http://www.yoursite.com/sitemap.xml

While the tag Disallow: with shouldn't block the bots it's something that isn't required and you should remove that line all together as well as the commented sitemap bit too from the robots.txt like so this becomes your new robots.

User-agent: *
Disallow: /ajax.php

Check your .htaccess file and let us know what you discover, is the site working for you? or is it just want webmaster tools is reporting?

  • Thanks for that! I'll update my robots.txt in a minute. The website "works". Sometimes it works, sometimes it doesn't. Namely when I clear my cookies (or use incognito), the first time it shows a blank page, and when I view the source, it shows the code in the question. Otherwise it shows the normal site. My .htaccess file is what it should be, so it's not that either. I've just downloaded the whole site (some 20GB), and I'm about to start a mass search the whole site!
    – Hosh Sadiq
    Jan 11, 2013 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.