SEO results hacked?

[MarcelMoz]

Hi Matt-POP,

Thanks for this opening, didn't look at it this way. All our domains got replaced by wearemesh in the cached page. The VWO code looks like ours, so do you really think they were testing? All of the source code is ours, also the canonical, only the domain got replaced by theirs..

We are using VWO but we are doing it by ourself. I'm not sure VWO is the problem.

This problem occured last Saturday. What we did on Friday is make our website mobile friendly for the scheduled 21st of April mobile Google update. Is this coincidence? The two companies who helped us with this change, made some changes to the canonical tags among other things.

A strange thing here is that a competitor has a same problem, wouldn't that seem like a conscious action (hack)?

@Patrick: We don't know them, for sure. If you go to the unkknown website, you see that they don't use our meta data, so that's the strange part.

Update: the domain www.wearemesh.com now redirects to www.ovsee.com, the same website you got redirected to when you click on the hacked result of the competitor I wrote about. The visual URL there is Finan.nl. This Ovsee.com looks like the perpetrator. But I still can't get a grip on it.. the other hacked result leads to www.planchemag.com which redirects to http://planchemag.fr.

What can I do to get my results back? I already filed a spam report in GWT.

Thanks again,
Marcel

[DirkC]

Hi Marcel,

It seems to be a plague recently- there where similar cases on Moz the last two weeks: http://moz.com/community/q/chinese-site-ranking-for-our-brand-name-possible-hack (similar situation as you) - a site being hacked http://moz.com/community/q/getting-different-search-queries-in-google-webmaster. It seems the hackers are exploiting a vulnerability in the slider used on these Wordpress site.

Apart from filing spam reports there is not much more you can do. You could inform the site owners that their site has been hacked & ask them to clean it, but I fear that these hackers are capable to switch sites quite fast.

Good luck,

Dirk

[MarcelMoz]

Hi Dirk,

This should be a Google task to prevent her customers/users from those kind of hackers right?

Do you think that redirecting my iPhone 6 page to a new URL would help? I can imagine the hackers hijacked an URL, when I pick a new one and 301 redirect the old one to the new, will my own result show up again?

I already spoke with Google this morning and they are going to look after it.

Marcel

[DirkC]

Hi Marcel,

Don't think that it will change a lot. If the hack is done in the same way as the other cases (which seems to be the case), they copied your entire site into the site which has been hacked. They present this version to Google (cloaking - as you can see in the cached version) - but "normal" visitors are redirected to a different e-commerce site. To make sure the hacked site is positioned well, they point hundreds of links from other hacked sites to the cloned version of your site. So whatever you change on your site, will not impact the cloned version, which will keep it's position, until Google takes action.

It's a quite a simple trick, and to be very honest, I am surprised that Google is not capable to detect it.

rgds,

Dirk

[MarcelMoz]

Hi Dirk,

I just set the redirect, just to be sure. This is a realy bad thing, people can abuse Google to negatively impact a whole company and lots of individuals. That should not be possible, hope Google will fix this soon!

You assume the whole site will go down in Google and not only those two pages? This will be terrible.

Marcel

[DirkC]

Hi Marcel,

If I do a site:www.wearemash.com there seem to be only 2 pages from your site indexed at the moment - possible that the other ones haven't been picked-up by Google yet. Quite ironical that the domain wearemash.com belongs to a web design company.

rgds,

Dirk

[MarcelMoz]

Hi Dirk,

That second result is our homepage, I see that this one got indexed at the exact same time our own homepage got indexed. However, Google shows our (the good one!) homepage in the search results.

That's quite ironical indeed, the webdesign company.

The other result redirects to planchemag.com, which only gives one result on a site:www.planchemag.com/. What about this one?
Is it possible this hack only limits to those two pages?

I used the tool copyscape.com and it seem to be only the following pages that are affected:

http://imgur.com/YVFcZsM

What about this one: search for site:soft-solutions.nl and you'll find our iPhone 5/5s pagina. Search for 'iPhone 5 hoesje' and Google shows our correct page as a result. How is this possible?

Marcel

[DirkC]

Hi Marcel,

I have the impression that soft-solutions.nl already discovered that they have been hacked & have cleaned their site in the mean time.

It's possible that the hacker only copied 1/2 pages - it's however more likely that they copied the full site but that the other pages haven't been indexed yet. Idem for copyscape - if the hack only occurred recently, these tools (and Google) haven't been able to pickup all pages yet.

When I search for 'iphone 6 hoesje' I get the planchemag.com site. As all these pages are duplicates, it's Google who's deciding which page it's going to show. Google decided that in some cases the hacked version is the preferred one, for other queries people will still get to your site. It probably depends on the anchors the hackers used to the hacked site. The volume of iphone 6 is probably higher than iphone 5 queries, so they will probably have used anchors containing 'iphone 6' to point to the site.

Dirk

[MarcelMoz]

Hi Dirk,

Let's hope the hacker only copied a few pages and not the entire site. What could a site like soft-solutions possibly do to clean their site? I think it's worth a chance to ask planchemag and wearemash to do the same. My new URL shows up if you search for 'iphone 6 / 6s hoesje', that's something positive. I filed a request for deletion of the old and hacked URL of the iPhone 6 page, hopefully Google throws it out and picks up the new and clean one like it does with the other search query.

I can do nothing but wait now I guess. I will keep you updated here.

Marcel

[DirkC]

Marcel,

When you contact the site owners - a good guideline on 'how to clean' can be found here: https://codex.wordpress.org/FAQ_My_site_was_hacked (specifically for Wordpress) - more in general: http://www.google.com/webmasters/hacked/ - it could be that the hackers gained access by a security issue with the slider (http://wptavern.com/critical-security-vulnerability-found-in-wordpress-slider-revolution-plugin-immediate-update-advised) so they should certainly check that Wordpress & it's plugins are up-to-date.

Good luck!

Dirk

[MarcelMoz]

Hi Dirk,

After contacting Google by phone and mail, filing a few more spam reports and refreshing textual content, we got our results back and traffic/revenue has grown since. We are very happy, and no other pages got attacked (yet).

Thanks for your help.

Marcel