Forum Moderators: Robert Charlton & goodroi
A hacker hacks some website (let's call it "website A" - the website that is hacked) and he puts there subpages with copies of our (Polish webmasters') websites (let's call my websites as "website B"). The copies are put into an iframe. We (owners of "website B") are not hacked by him, he just copies code of our website and puts in the iframe on "website A". Now, the problem is that Google algorithm in many cases considers the malicious copy put by hacker on website A as THE ORIGINAL and the website B (our website which is the original) disappears from Google results.
2.5 we wrote a lot of text. It turns out that in some way, this nasty man created "something" that pretends our site and Google for it grabs and throws our content from search results.
Our content / subpage was replaced hack subsites in Google! And when you come from the presence in Google, you will see a malicious website which earns a hacker, but can not see our content. And this type of pages is at once more.
[edited by: Robert_Charlton at 8:35 pm (utc) on Feb 9, 2016]
When I type "mysite.com" into search the offending site returns first with my sites snippet and the title of my site.smb111, thanks for the additional information, which helps. As you initially described the problem, it sounded like the site might have been hijacked. The additional information makes me believe that this is most likely not a hijacking... though that's not a possibility one could yet rule out completely.
(If your site’s ranking is impacted by a manual spam action, we'll also notify you in the Message Center in Search Console.)This suggests that you should be able to check your penalty status, to some degree anyway, online.
I am almost positive there is not a penalty
When I add the offending domain which is copying my content into the search box and I select any browser as user agent, I get a 404 error. But when I change the User Agent to googlebot, I see the source code from my site. So it's showing different content to google and the user.The 404 indicates that the "directory" site is set up to avoid normal manual inspection... and if you just enter the url in your address bar, that site you bring up should also get a 404, as it's not the content that's been fed to Googlebot... but is the content the hijackers want to disappear. (smb111, this is what I derive from your description. I hope it matches your experience).
(is) not about someone directly hijacking your traffic through some kind of DNS exploit. You're also not talking about someone strealing your content, although that can play into this picture at times.
Instead, you are talking about a proxy domain that points to yours taking over your position in the SERPs, sometimes a position that your url has held for a long time....
...conceivably the hacker/hijacker's business model might be to go after private user information, or they could be spreading malware, or whatever. These aren't nice people.I should have emphasized this more strongly and should have repeated the thought in my last post. I'm repeating it now.
The most fool-proof and low-maintenance method to validate Googlebot requests is to do a double reverse-DNS lookup on the IP address requesting as Googlebot; If the IP address points to a Google hostname, and looking up that hostname then returns the original IP address, then it is legitimate Googlebot request.
This is the method recently recommended by Google in their Webmaster help -- doubtless due to this very problem.
However, some servers are configured such that the Webmaster cannot do rDNS lookups. In that case, just using a simple list of the IP addresses that Google usually crawls from is a viable solution -- IF you keep a sharp eye out for Google changing or adding to the list of IP addresses that Googlebot uses to crawl.
[edited by: Robert_Charlton at 12:47 pm (utc) on Mar 2, 2016]
Google's Michal Wicinski posted an update in the thread this morning basically saying that the Google team who handles this sort of hacked spam is now on the case. He wrote, based on Google translate, "the team which is responsible for this part of the search engine looks at the problem." //
He did ask for webmasters to help and give more examples:If you notice other examples Twoch replacement pages for the benefit of the parties, which compromised the examples in the form of vapor URL {URL of your page that disappeared - URL of the page with burglary} will be most helpful and speed up finding a solution.
We've taken advice from above refernces and added base href and blocked the domain/ip in htaccess. Unfortunately we're on shared hosting and cannot rDNSFrom what I remember from old discussions on this, and remember that I am not an IT specialist, there is a problem with simply blocking the domain/ip address... and that is that the hijacker can easily change IPs.
[edited by: Robert_Charlton at 12:10 am (utc) on Mar 4, 2016]
[edit reason] Anonymized example domain [/edit]
