Web search question

My web site allows me to know what keywords people are finding me by on the search engines. Usually, the keywords make some sense, but in the last two months, I have apparently been found by the keywords "lipitor" and "vicotan". At least that is what the keyword summary is showing me. I know these words are nowhere to be found on the site (or at least I am assuming it has not been hacked).

This month is "vicotan", with no other keywords, so far.

Any ideas as to what is going on, or how to hunt this one down?

Are you sure your site hasn't been hacked? I think that that it has. I had a similar situation with some pornographic terms a couple of months ago, and sure enough I found some html files for those terms in some old image folder. You need to look everywhere, in every folder for signs of hacking.

What are these "signs" of hacking Ron? I noticed a reference to Welbutrin as a keyword on my site the other day and was scratching my head over that one.

When you say the site may have been hacked, what exactly do you mean?

Ron, I don't think it has been hacked, but I'll check more thoroughly. It would be kind of wierd to put something like this in there without an obvious way of getting there, but there may be some stray unlinked file running around.

Not(!!!) wanting to sound sarcastic, but I have to second Bill's question. Any suggestions of what I might be looking for, in particular, other than the obvious "that sure ain't my file" type of thing?

You need to look very closely at your site – the version on your web host’s server, not the version on your home computer. You can use an ftp program or the file manager in CPanel to do this.

You want to look for any file that doesn’t belong. Look in every single folder, they may try to hide the files. In my case they were in an old image folder.

I suppose it is possible they manipulated an existing file as well. You might try looking at every page on your site for anything fishy. Better yet, you might also try sorting the files in each folder by most recent date – are the ones at the top your newest, or is some old file?

I found the hacking by looking at my log files. I could see people arriving via the strange search terms were arriving at pages I didn’t recognize. Depending on your web host, this may be your best way to solve the mystery. My site provides stats (via Webalizer) that let me see the refering website, the call it the refer. By clicking on this, I can go back to the serach results and see exactly how and where these people were going. If you have Webalizer this is an easy way to track down those users to see what page they are landing on - this may answer your question. I think I gave the best advice last.

I’m far from an expert on this, in fact I barely understood what was going on when it happened to me. Others here may have better advice.

I hope that helps Bill. Good luck!

I discovered my situation after my visitor numbers went through the roof. After I figured out what was going on, I passed the information on to my web host as a FYI. They responded and said their servers were hacked and many websites were compromised. They thought they found, and eliminated the problems, but most have missed my site. They were very apologetic. Funny, I had know idea the situation was their fault due to a lack of security until they started apologizing profusely.

Thanks Ron!

Do you have Google Ads on your web site?

Actually, I don't know if a search would turn up words in a Google Ad. Just a thought. Some of those Google Ads can be way off topic of what's actually on your page.

I'm missing something. What good does it do any outside party to drive traffic to "my" site?

That is an excellent question Jim, and one I was never able to figure out. I intended to ask on one of the SEO forums but was on the road at the time and never did. I do have a few theories.

1. My site performs very well with Google. Maybe by having their pages with my URL they can piggy back on some of this Google goodwill. Without me actually linking to their pages, I really doubt it. Maybe they hid some links within my actual pages, although I never did find any. I could see through Google Links that they did actual gathered a bunch of outside links and had them pointing to those pages on my site!

2. These pages also more than pushed the limit of acceptable SEO – I wouldn’t be surprised if Google would ban such pages. Maybe they need to keep moving to new URL’s once Google bans them.

3. Maybe they were having trouble finding web hosts with such offensive material. By putting the worst of it on my site, they could then forward surfers to their actual site where the material was more “hostable”. If I remember right, the pages on my site all lead somewhere else.

Maybe it was a little of all the above.

As a side note, I decided to have a little fun at the hacker’s expense. I used the editor in CPanel and deleted all the content in each of the hacker’s pages. I then added a redirect to the most ominous page about sexual predators on could find on the FBI’s website.

So this is what would happen. A pervert would go to Google and search for child pornography ( not the actual words – I can’t repeat the actual terms) In the search results the pages on my site would show up about third. Then when the perv clicked on the search results they were immediately taken to the FBI website.

I realize the FBI isn’t going to do anything, nor would they even be aware of what’s happening. I figured it might mess with the heads of some of the perverts – giving them the impression that big brother is watching, or tracking their activity somehow. It lasted for a couple of days until Google fortunately removed those pages from their results.

You should be able to tell from your referring pages and your in and out links from your statistics package where the search requests are landing.

Review those pages and see if they have been altered. You can also use the Google site search feature (under advanced) and search your site for those specific terms and see where it goes. I started to but thought that showing up on your log might

If someone has been in your site I would contact your host and dump your site and reload it if you have a local copy. I would be worried about access to your mail server and tracking of key strokes or online sales if you do that on your server.

Rob, I don't do direct online sales for exactly the reasons you mention. This would mean an upgrade to security in the site which I am not ready to handle. I figure if someone really wants a print or a file, I can work it out either by e-mail or phone. I may lose the spontaneous purchases that way, but I can live with it.

Rob has probably the easiest suggestion: go to Google and enter:
site:your.site.com search terms in question

This will return only matches on your website, and will point you directly to wherever the hacker placed his content.

Jim, the advantage of putting illegal or questionable content on your site and driving up "your" traffic is that they don't have to pay for it, and they aren't likely to be caught doing anything illegal since it's *your* site. They're freeloaders and criminals looking for a dodge, nothing more.

Dan and others: the fact that your site is turning up in searches for Vicodan, Wellbutrin and other drugs is a pretty good clue that you've been hacked all on its own. You're a photographer, not a drug promoter - your site shouldn't have anything to do with that kind of stuff, so if you're getting hits based on searches for drugs (or porn, or anything else unrelated to your website content) then chances are you've been hacked.

It's theoretically possible that your site is okay. Your web logs determine search terms by looking at the REFERRER header of each request to your server; that header can easily be faked, but why anyone would want to is beyond me.

Les, thanks for the idea. Actually, this was one of the first things I did when I found the weird keywords and nothing came up. I'd almost be happier if something did show up - at least it would point me to the appropriate crap on the site.

Thanks again.