Our website is being attacked in a curious way: on the Search Results Page, Google is showing links that look as if they were to pages on our site but they direct to some shady viagra-selling sites.
I've done some research and found no trace of those pages on our website (Nginx + Wordpress).
I tried to curl some of those links
curl -X HEADER -i www.oursite.com/pilule-de-viagra/and got those results :
HTTP/1.1 302 moved Temporarily Date: Tue, 02 Feb 2016 13:46:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 X-Pingback: http://www.oursite.com/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Location: http://www.oursite.com Vary: Accept-Encoding X-Powered-By: PleskLin MS-Author-Via: DAV Server: shield Via: 1.1 google
What kind of attacks is this, i.e. is this some malicious code injected in our server or is it some black-hat SEO hack that operates without having access our servers?
And most importantly, how to deal with this stuff?