sitemaps hacked??

Neonblitz · #1 07-27-2006

I am a web designer. Last night a client emailed me some strange results when she looked up her site in google. If you do a search depending how you get back some variation of this in the sitemap description of her website: nudecelebs sex porn free · porn sex porn free.
Or: hairy sex porn free. It will also look different in other search engines some not showing it at all (yahoo) and others using variations of the words.

I can't figure out how this is happening. I did a google search of "hairy sex porn free" with quotations and it showed up a lot for legit websites in their sitemap descriptions.

Those words are not embedded in the html. How is this happening? I have emailed google and the ISP still waiting to hear.

Neonblitz · #2 07-27-2006

just a little more information. The site in question is a seasonal grocery store on the coast of Maine, primarily serving a summer resident population. Has no one heard anything about how this is being done?

FreeAgent · #3 07-27-2006

Can you PM me a link to this website? I would love to do some research on this.

Neonblitz · #4 07-27-2006

Freeagent your account doesn't acceptPM's. The url is islandgrocery.net

FreeAgent · #5 07-31-2006

I'm not finding any of the results you are talking about. Are you still seeing these results on your end?

Neonblitz · #6 08-01-2006

type: islandgrocery.net into Google look at the results. This is what I see: menu_home. IG. store nudecelebs sex porn free · porn sex porn free. spacer. Eva and Annie · store · counter · wine · porch · customer. spacer freeware ...

Rob M · #7 08-01-2006

I can see what you are talking about however I'm not sure what's causing it. I'm interested to know though but I did notice it's only on the home page in google, other pages are ok.

it only displays that information on islandgrocery.net however the full url at www.islandgrocery.net is ok.

dazzlindonna · #8 08-01-2006

only thing i can think of is someone doing a 302 redirect hijack on the site at some point. not even sure that would cause that to happen, but maybe?

wp9 · #9 08-01-2006

hi

if u see properly in google u can see 17 pages of this site.. and result for your home is shown twice with different description but it doesnt have any data about cache date of the website... this make me suspect of 302 hijeck.. you must check on this...

Following two result you get to see in google about your home page

Island Grocery, South Bristol, Maine
menu_home. IG. store nudecelebs sex porn free · porn sex porn free. spacer. Eva and Annie · store · counter · wine · porch · customer. spacer freeware ...
islandgrocery.net/ - Similar pages

Island Grocery, South Bristol, Maine
menu_home. IG. store. spacer. Eva and Annie · store · counter · wine · porch · customer. spacer. Come in for a visit. © 2006 Island Grocery. ...
www.islandgrocery.net/ - Similar pages

g1smd · #10 08-01-2006

Looks like a classic 302-redirect URL-hijack to me.

Google said they had fixed that problem more than a year ago.

[OK, I was wrong. Matt Cutts confirms the correct answer below.]

g1smd · #11 08-01-2006

You might want to ask reddoormedia the following questions:

- Why are there links to reddoormedia without anchor text in them?
- Where is the meta description? You don't have one.
- Why is there no redirect from non-www to www on the site?
- Have they got any clue what semantic markup is all about?

MattCutts · #12 08-01-2006

"Looks like a classic 302-redirect URL-hijack to me."

Nope, not at all. To me, it looks like this webhost is cloaking. Then including links to porn on the cloaked page that is served to Googlebot. Neonblitz, this is just me speaking my personal opinion. My personal opinion is that if you find out your webhost is cloaking, monkeying with your content, and adding porn links to your page, you'll want to think about whether that webhost is treating you with the respect you deserve.

MattCutts · #13 08-01-2006

Alternatively, if your webhost claims that they weren't deliberately cloaking, but were "hacked" somehow, is that still a webhost that's doing a good job for you?

Neonblitz · #14 08-01-2006

type into google with quotation marks: "hairy sex porn free"

Now look at the list of sites it brings up. This seems to be going on in many places and with many variations. So I doubt it's just my ISP who I have been using for years and have many clients with. But maybe...I did email them and they said it was a Google issue.

dannysullivan · #15 08-01-2006

To be clear, it's not your ISP. What Matt is saying is that your web hosting company appears to be adding this content to your pages.

See this article:
http://blog.searchenginewatch.com/blog/051007-084336

It explains the concept more. You need to ask your web hosting company if they are doing this.

Note that for Island Grocery, they are not using a noarchive tag yet the page itself is not being shown as a cached version. If that's the case, then were is the tag? Answer, Googlebot appears to be shown a page that's different than what you or I are seeing.

g1smd · #16 08-01-2006

Thanks for adding the correct answer Matt. I did not go looking for cloaking, as, well, who the heck cloaks on a local country store in the middle of freakin' nowhere? I did see something else that looked like a 302 hijack very recently, and assumed this was yet another; but obviously you have all the cool tools to look much deeper into things.

MattCutts · #17 08-01-2006

Happy to help, g1smd. You got my attention.

wp9 · #18 08-02-2006

Thanks Matt

this is good learning...for me too

MattCutts · #19 08-02-2006

Neonblitz, it's not your ISP, it's the webhost. Either they're doing something malicious, or it's possible that e.g. your cpanel was hacked.

g1smd · #20 08-09-2006

Heh, Neonblitz you could not have had a more authorative answer, is there any resolution?

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)