Hot answers tagged

10

Google does not just ignore links in sections that are display:none. Consider DHTML multi-level drop down menus. In such a menu, you hover over the top level menu item and a list of links drops down. That is a case in which the links are in display:none initially, but user interaction with the page shows them. Using drop down menus like this is ...


6

Not all countries have strong copyright laws. This is unfortunate. In the U.S. and Europe, there are legal actions you can take. In India (I may be assuming too much here), I have no idea. I suggest contacting an attorney and simply ask a few questions. In the U.S., this is a criminal act and any civil action can result in recovering payment for damages plus ...


4

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


4

I'm assuming that the bind.php file is not actually a part of Joomla, but rather a malicious script that the hacker uploaded to your site. In particular, just looking at the request parameters, it appears likely that the script is being used to send e-mail spam, possibly using someone else's hijacked e-mail account. Here's what the request parameters in ...


4

I think what has happened here is that the other website has stolen your website's content, and passing it off as it's own. If you do a ping request on that website's URL it's IP address is should be different to your own website's IP address. I would message Google via Google Webmaster Tools and inform them of the other website and they will act ...


4

Reset the account password Since you are the owner of the e-mail account you can always try to reset the password for that Google Apps account. Support center pages There are many pages on Google's support center that deals with this kind of stuff: Reporting Abuse Incidents Deals with this kind of stuff. It says: If you believe that someone else has signed ...


4

There are no rules. A user agent can be anything. There's no reasonable way to whitelist user agents as there are a lot of legitimate ones and you do not want to accidentally block a legitimate user. There's also no way to block bad user agents because, once again, there is no standard way to determine if a user agent represents a bad user. If you want to ...


4

No hacking method has been described, rather the result of an unknown method of access that has allowed the ability to change or add files to the server filesystem. First step is to find out how they got in to change such a low level file. You need to determine whether: They were able to gain access to either your cPanel, ssh or sftp via weak, guessable ...


4

I think you’ll find that those are IP addresses for Google Cloud Platform, meaning that it’s not Google themselves but third parties running their own code on Google’s platform. So Google isn’t trying to hack you, it’s selling computing services to the public, some of whom are hackers.


3

For example, do I need to worry about the MySQL databases themselves being compromised? Or if I manually move them would they be ok? Yes, you absolutely have to worry about the MySQL being compromised along with just about everything else. The best thing to do here is move as little as humanly possible to preserve the content. Plugins, themes, etc should ...


3

So, I have had the exact same issue with a WP installation on iPage. After a lengthy discussion with support about the issue, I found out that after the query limit of your hosting plan is reached (for whatever reason that may be... such as bugs on your site...), iPage automatically re-directs to www.yourdomain.com/wp-admin/install.php. Now, it does this ...


3

Did you follow the guidelines for removing the malicious codes and following the hacked site guidelines? The last step is submitting a request for review, which can be done here: https://support.google.com/webmasters/answer/2600725?hl=en To expedite the process, I would submit a fresh sitemap to Google, but I would give it 7 days.


3

Honestly, there may be a true virus on your site. These exist solely to hack Wordpress websites and no amount of re-installing and re-deploying will stop it short of a complete anti-virus scan including rootkit and possibly wiping the hard drive and starting over if necessary. As well, make sure that ALL of your software is fully up to date especially ...


3

There is a good chance the problem has nothing to do with a user/login, but with the permissions set to the files. If one php-file has too many rights, and they know how to abuse it, you've got a breach like you've described. In normal settings, directories should be 0755 and files 0644. Directories which have changable content (need to put files in it) ...


3

Analyzing this remotely is almost impossible, but here’s my guess: You did not patch/update your Drupal installation quickly after the security advisory SA-CORE-2014-005 was published. This was a highly critical vulnerability, referred to as "Drupageddon". An attacker exploited the vulnerability and got access to your installation. The attacker created ...


3

Your web server contains a configuration file with a configuration that directs traffic from certain sources to pages with the suspicious script. If you're using apache, start with the .htaccess files in your document root folder and every folder recursively within it. Look for any lines containing "user_agent" or "remote_addr" or even google or other ...


3

Cross-site scripting (XSS) is a type of computer security vulnerability. XSS enables attackers to inject client-side script into webpages viewed by other users. Add this to the .htaccess file in the website main directory. <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" </IfModule> This header enables the Cross-site ...


3

fixed now How was it "fixed"? I can guess... it seems that your website is accessible by both the IP address and the domain name. My guess is that this other website accidentally pointed their domain name at your IP address. Maybe the IP address was similar; although the IP address that their domain now points to is quite different. Either way, this does ...


3

These are usually hits from bad bots. Unfortunately, it is very common for bots to attempt to lowercase the entire URL. I have a website with mixed case URLs. I get thousands of hits per day for URLs that have been incorrectly lowercased. Here are the top user agents that did so yesterday: 20494 Mozilla/5.0 (compatible; Gluten Free Crawler/1.0; +...


3

The short answer to your question is no, there will be no problem doing that but I'll definitely keep a fake /administrator and /wp-login.php files. That will keep bots and strangers occupied for nothing. On the other hand, I'd take into consideration: Password protect the real server Limit login attempts Allow access to login files by IP Change default ...


3

Your Apache is improperly configured. Apache should only respond to properly configured domains. Somehow, your Apache is configured to respond to any domain, which is your problem. Check your config for something like this in the VirtualHost block ServerAlias * That could be your problem, as Apache will now serve up any domain for that virtual host. ...


2

It is likely to be either the FTP passwords or some common software that is powering the sites. For example it is very common for an old version of WordPress to be vulnerable to this type of an attack. You should: Change your FTP passwords Update all the software powering your sites. Google just released a set of resources for Webmasters that have been ...


2

I like the idea of using hash sums to check for changes in files. I don't like that the one you link to is installed on the server itself. If the server is hacked, that file is likely to be modified too. I would use a command like this to ssh into each remote server and checksum all the important files in the web directory. ssh mywebsite.example.com '...


2

A few simple options to automate malware scanning of multiple sites: Use a paid automated malware scanning service such as Securi, 6Scan or SiteLock. You might want to encourage your client to sign up with these services, or offer it as part of a monthly maintenance contract. Use a free plugin for your content management system, such as Wordfence for ...


2

Possibilities ModX EVO CMS is deleting it Malware/Virus is deleting it Shared Hosting is causing it, i.e malware/virus on another user account spreading to yours. Web host is deleting it for one reason or another. How to Investigate Contact your web host if shared hosting Check logs Quick Fix I'm assuming that you are using CHMOD 744 or 777, there is no ...


2

I think black hats SEO just wanted to hack this website without being detected by the webmaster. Indeed, putting hidden links in a webpage is out of the guidelines edited by Google. However, it doesn't mean that doesn't work for SEO. In general, it doesn't work a long time.


2

I have this on some of my sites, whilst not a perfect solution I used MaxMInd GeoIP to block countires in Eastern Europe & China. This reduced the number of bad signups by over 90% for me. GeoIPEnable On GeoIPDBFile /path/to/GeoIP.dat SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry # ... place more countries ...


2

My guess would be that they're crawlers which haven't received a particular order to sign up for your site, just sites in general. I can't imagine why they would sign up and then never post anything; perhaps your post button/form is oddly set up so that they can't use it? If you want to prevent them from registering (the ones which get past the captcha), you ...


2

If a user is using a proxy, there may be headers in the request that you could examine or log to let you know what the original IP address of the user is. See: X-Originating-IP X-Forwarded-For If you are using Apache server, headers such as this can be logged using %{header}i, in the log format configuration directive where "header" can be any HTTP request ...


2

I would be tempted to email anyone who has signed up and not posted to ask them if they are having trouble - good customer service! - and if their email addresses bounce, or they respond with junk then delete their accounts. I +1 mikey_w because on a reasonable size discussion forum (1,000+ posts a day) I have worked with, I do indeed find that spam bots ...


Only top voted, non community-wiki answers of a minimum length are eligible