Google's view of a web page is corrupted

Question

Recently, one of my website has been hacked in a very interesting way.

By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it.

Note : I am going to describe my website but after looking at other hacked websites, they all have the same behavior and look like the hack has been spreading.

Few information about the website :

• is using wordpress,
• is executed by apache

Information about the hack :

The website hasn't changed of any way. I still have my only page with a clean source code, which hasn't changed at all.

The way I've noticed that something was wrong on the site is that the title and description on Google suddenly became in Japanese, with some keywords like iPhone, Samsung ans other popular brands.

I then tried to domain search it on Google like site:mywebsite.com. This gave me around 12k results (when there should be around 15 maximum), all being pages that redirect me to 404 with title and description in Japanese. All these pages have a cache version with different Japanese content.

When I try to look at the website "like Google" in the search console, I see the website being displayed like the cache version. There is some code in my website that targets Googles bot and create fake urls for it.

This looks like Pharma Hack, but the difference is that they are not trying to make any back-linking. There is absolutely no link that redirects to something else than my website (home or 404). Maybe it is more NSEO ?

I know that WordPress is one of the worse thing security-wise. But my question is more security oriented. Is this a known hack ? How does somebody target google's robot to make him see a totally different website that the one that I made ?

Answer 1

As mentioned in the comments, try this command to see if the malware is not returning different content to browsers and bots (just use your own URL):

curl -H 'User-Agent:Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' \
  -H Pragma:no-cache \
  https://httpbin.org/user-agent

And the attack may have targeted Google for a number of reasons:

• turn your page into a SEO backlink farm
• attract traffic from specific user agents only (e.g. mobile browsers) and only show infected HTML to them

This also might not be an infection at all, these symptoms could be present in the following cases:

• broken virtual host configuration on your web server - e.g. different page returned when accessing it through www.example.com and example.com because on of them is not configured explicitly to return your page and returns a default web server contents, which happens to be someone else's website (e.g. on shared server)
• broken DNS configuration, resulting in Google bot speaking to a different server than you think it's speaking to

You might try to use some cloud-based web site scanners to see how your website is rendered from the outside world - e.g. scan it on WebCookies.org and see if the title and description matches your website.