2

If anyone can help, I'd be very grateful! We're getting strange domains coming up in Google webmaster tools - they seem to be breeding. When I look where the links are coming from, it's either:

  • non-existent pages on our website (usually) or
  • some other site URL

I'll give some examples:

  • hechenghai/article/enquiry/frmenquiry.aspx
  • sql-server-reporting-services-training/~/ms-project/~/stored-procedures/~/enquiry/frmenquiry.aspx
  • blogs/BradSchacht/ssis/blog/blog/enquiry/frmenquiry.aspx

I'm sure Brad Schacht is a great guy, and hechenghai a great place, but I'd never heard of either of them till they turned up in Google tools, and they're certainly not on our website.

Some things to help:

  • I have a simple site map which Google knows about, and have checked this.
  • We don't use an htaccess file (it's all in Windows)
  • we don't use any illicit or black-hat techniques
  • we generate the site from a .NET system which writes out the HTML pages

You can see the site at http://www.wiseowl.co.uk

Improve this question
7
  • Your site has been attacked with malicious codes!
    – Raja
    Jan 29, 2013 at 11:15
  • Tell me more, please ...
    – Andy Brown
    Jan 30, 2013 at 11:57
  • OK, I've run Google site check and about 4 other tools to check for malicious codes. We appear to be 100% clean.
    – Andy Brown
    Jan 30, 2013 at 12:07
  • Sorry for the delayed reply. malicious codes might be in your database or in a file. I can not give exact solution. But you can try the following steps (I had done the same for my website). 1. Take a backup copy of your db as sql file. 2. Search sql file with non-existence url. 3. Do the 2nd point for all your files too. 4. You may find some code (may be js code).
    – Raja
    Jan 31, 2013 at 5:50
  • Thanks for this. Sadly, we've already done it. We've searched every text field in every table in every database for the URLs, and also every file, as this is what we thought first. Was yours in JS code? The only thing left to think is that someone has hacked our Facebook, Twitter or Google Analytics JavaScript code.
    – Andy Brown
    Jan 31, 2013 at 7:59

3 Answers 3

Reset to default
5

Let's analyse your examples. All three have on thing in common: /enquiry/frmenquiry.aspx. That makes it worth googling for. One of the results is this question, but there are several others, a few of which actually display the HTML source code instead of the rendered HTML. That is a classic attack vector for compromising web sites.

I would surmise that your site is feeling the effects of a badly configured vulnerability scan. It seems that the scanner has a number of URL and he just exchanges the domain, then scans for them. And since Google found them, the links themselves must have been available somewhere, sometime, maybe on the scanner's website.

Have you found any of these 404 occurrences in your error log? They should provide additional information as to when and where this event started.

Improve this answer
4
  • That sounds incredibly helpful - I wish I understood it. Could I possibly ask you to explain further? I'll certainly have a look at the error log in the meantime - doesn't help I'm away till the weekend. Btw, I really appreciate the help.
    – Andy Brown
    Jan 22, 2013 at 22:40
  • Think I get it now. Do you mean that someone has compiled a list of URLs, and presumably published them somewhere, which are part genuine and part rubbish because the computer program involved wasn't properly tested? If so, do I just need to find the source site and block it in robots.txt? And why has this a such a drastic and sudden effect on our search ranking?
    – Andy Brown
    Jan 22, 2013 at 22:46
  • @Andy: You can't block a foreign domain in your robots.txt.
    – unor
    Jan 23, 2013 at 9:41
  • Indeed - I knew that really. Still can not get to the bottom of this.
    – Andy Brown
    Jan 23, 2013 at 23:24
2

This is the case of URL masking, in simple words your site has been attacked with malicious codes, so your site is showing the url of other sites in your url.

You have to do the fresh installation of your site.

The best way is to take the backup of your database and then go ahead with the fresh installation.

Note: Try not to use any code files from the previous installed system other than images, for the malicious codes are often hidden in the code files.

I too have faced the similar issue. For more info check the below link, this might will help

http://www.willmaster.com/library/web-development/URL-masking.php

Improve this answer
3
  • Thanks for this. However, surely if that was the case then searching site:www wiseowl co uk BradSchacht (for example) would show this phrase embedded in one of the page's HTML? Also, we generate most of the pages from an SQL Server database, and I don't believe this has been hacked? I've read your link, and still am not sure if it applies, but I'll look further.
    – Andy Brown
    Jan 22, 2013 at 21:06
  • I have a site on WordPress which has the same issue. Wordpress also fetch all the data from the SQL server, but apart from the the database there also exists other configuration, plugin and other .php files. In your case it will be .aspx files. Have you tried restoring the site only using the database backup. I am sure it will help. As it worked for me.
    – Sidh
    Jan 25, 2013 at 11:15
  • After restoring from the database, the changes in the Google Webmaster tool will only appear only after when Google bot again crawl your site.
    – Sidh
    Jan 25, 2013 at 11:18
0

OK, I think we may have found the answer. Google was reporting hundreds of ASPX pages as 404 errors, and we assumed that this was what was going wrong. In fact, this was what was going right. The real problem was that when anyone went to an HTML page, IIS was configured to show a different page, which returned a 200 error.

So if a dodgy link existed on an outside side to a Wise Owl page which didn’t exist, this linked page would be treated by Google as genuine, as would any pages linked to from it. So the number of pages indexed by Google but actually not existing would have grown exponentially over time, which eventually led to our penalisation.

Still not sure if this is correct, but it sounds plausible. We’ve now removed the 404 page from IIS, and we’ll see what happens!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.