Is my site hacked with spammy fifa coin links?

[MikeTaylor]

Google search console threw up some URLs from my site tha haven't been indexed.

They seems to be spammy links to a fifa coins site.

But I didn't create them

Any help would be hugely appreciated.

Best

Mike

[MikeTaylor · Accepted solution]

Hey.

I just had the similar reply (see below). They're obviously aware of the issue and have decided this is how they deal with it for now. I feel that this issue is bigger than "it's just a thing you can't stop and doesn't matter - get Google to disavow them..."

Hi Mike,

Thank you for reaching out to us. My name is XXXX and I am here to assist you today.
I understand there are some unauthorised activity initiated in your store and I would be more then happy to resolve this issue for you.

I've taken a deeper look on all the information you've provided on the thread and I am very happy to share with you that your store is safe and it is just a little bot running wild.

The odd-looking url and domains that you have posted on the thread are actually search terms of what some visitors to your site have actually searched.

This search term is usually distinct from typical searches on the site (such as being in Korean on an American shop, and including a domain) and may span up to thousands of these kinds of backlinks. It can be a bit scary for the merchant but there are no real security concerns here.

The technical term of what has happened is called Spam Backlinks. I get that this is not exactly the most pleasant thing to have so I have attached a link here on how you can potentially stop it from happening.

Whatever that is happening at the moment does not pose any form of threat to your store in anyway. Taking that into consideration there are 2 courses of action here that you can take:

Option 1: Not take any action as none is actually necessary and taking steps would not do anything other then removing some search data that is not affecting you now or in the future

Option 2: "Code" it away
Using your SEO reporting software (Which in your case is Google Search Console) you can collect all the bad backlinks into a .txt file and report them via Google's Disavow Tool. Information on the structure can be found in their help doc here. Note that the backlinks to list will be the referral site address rather than their search term URL.

Please understand that option 2 is fairly complicated and in light of that I will need to share this disclaimer with you pertaining to Option 2:

This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site's performance in Google's search results. We recommend that you only disavow backlinks if you believe that there are a considerable number of spammy, artificial, or low-quality links pointing to your site, and if you are confident that the links are causing issues for you.

**

[Mark1988]

Hi all,

This negative Chinese SEO spammy backlinks were scary (and still are a bit). Have walked this path already some weeks now, and in the meantime am able to get this url's successfully out of the Google indexed pages (to have them not indexed). Most of them are out, only need to get some few hundred out more, since some have a slightly different url with /en/ in it.

Have followed up the steps in above, by:

1) delete the beginning of the url's in the Google Search Console:

- https://......../collections/vendors?q=

https://......../en/collections/vendors?q=

2) by adding in Theme code under theme liquid the 'no index' code. (Maybe i added a little to much blocking code, but better to much then to less i guess)

{%- if request.path == '/collections/vendors' and collection.all_products_count == 0 -%}
{%- endif -%}

</head>

{%- if request.path == '/collections/vendors' and collection.all_products_count == 0 -%}
<meta name="robots" content="noindex">
{% elsif request.path == '/404' %}

{%- endif -%}

{%- if handle contains 'collection/vendors'-%}
<meta name="robots" content="noindex">
{%- endif -%}

Still am wondering how to get these url's out of the Google Search Console completely, as they give these technical errors in the Google Search Console (i like to have things cleaned up). If someone have tips or tricks for that, pls let me know.

Believe the main reason Shopify owners got this problem, is by 'cheap' Gigs on Uppwork or Fiiverr, where you let 'experts' people into your theme. Have two thoughts about it:

1) or your site comes then under attention (be noticed) and you become intresting for this negative Chinese spammy negative backlinks attacks. (on the other side, for example my website is also on the product package, so it could already also come directly from China itself).

2) The things of point #1 + that the 'bot' that is mentioned earlier is getting installed somewhere in your theme code. Hope point #2 is not true (which means to people that you are cooperating from that platforms are not so legimate), but it could also be the case since in above there is mentioned also things about 'apps', which will give a html code in your theme code as well.

Hope my contribution on the topic will help some people and help Google and/or Shopify to find out the source and the permanent solution to annihilate these evil schemes.

Greetings, Mark

The Netherlands

[Denny10]

Hi Mark,

putting noindex into the header is not neccesary anymore, because Shopify updated these pages - 404 errors are the new output.

I don't think anything is put into the theme code. The bug could be perfectly done without any access to the backend. Anyone could create those URLs on it's own and add any type of content. The only things that were needed for an indexation were backlinks as you have mentioned in possibility 1.

I don't see any way to clear the search console - as they are 404 errors right now they might be flagged as 404 errors, which would make the GSC much cleaner. But Google would need to crawl these pages again.

[Denny10]

Hi Jen,

this will make it more tricky. You'd need a webdeveloper for this. The search is often blocked by robots.txt, so Google is not able to read a noindex tag, which you could add to the page. As the search is important, Shopify can't put a 404 error on those pages.

What I'd do:

1. Request removal of all URLs starting with https://yourpage.com/search?q= - make sure, that you don't have indexed any search query that is important. You can do that by typing site:https://yourpage.com/search?q= into Google. This removal will expire in a few weeks/months. That's why you'd need to do further things.
2. When there are pages indexed and also blocked by robots.txt, delete the blocking statements in the robots.txt and start the troubleshooting. This will probably take a few days, depending on the amount of pages.
3. After the troubleshooting is done, add the deleted statements to the robots.txt again.

[Jizo_Inagaki]

Hi Jen.

I think the following code will output noindex when there are 0 search results.
However, it is not well verified, so if you use it, please check it carefully by yourself.
If you are not sure, please consult with a Shopify partner or expert.

{% if request.path == '/search' and search.results_count == 0 %}
  <meta name="robots" content="noindex">
{% endif %}

Notes.
Shopiyf may add a process to return a 404, which may soon be unnecessary.

Details are on my blog.
But it's Japanese, not English.

https://webutubutu.com/webdesign/11116

[JenDeg]

ありがとう！

(((Thank you so much!!!!))) I'm going to dig into this now and will come back to let you all know how it went. Also, I'll Goggle Translate your blog. The other code you provided has worked like a charm, so I expect this will do the same. 

Total rock star! Also, if you are available for hire, I'd work with you in an instant. You can look me up on LinkedIn if interested (Jen Degtjarewsky / Jennifer) - Jen@MediaLabOne.com

[JenDeg]

Hi Everyone - Have spoken to Shopify, who spoke with their dev team and they say this is the preferred solution. I'll post both below for anyone having these issues:

NOTE: Both go in the theme area (theme.liquid) - Line 4, after the  <head> tag.

#1 - Solution for attack on VENDORS page:

{%- if request.path == '/collections/vendors' and collection.all_products_count == 0 -%} <metaname="robots"content="noindex">{%- endif -%}

#2 - Solution for attack on SEARCH RESULTS PAGES that return zero results:

{% if request.path == '/search' and search.results_count == 0 %}

  <meta name="robots" content="noindex">

{% endif %}

CREDIT: Both solutions were created by Jizo_Inagaki who is a rock star in my humble opinion. 💪

[Jizo_Inagaki]

Hi JenDeg.

There was a problem with my answer and I thought it would be better to put the code together, so I created the following code.

Problems with my solutions:

• Shopify's robots.txt has the entire search result set to Disallow
• Search engines cannot recognize a noindex on the search results page

Necessary Action:

• Remove Disallow for search results from robots.txt
• Output noindex to necessary pages

■ Caution!

I am not good at writing English, so there may be some writing errors.
Here is how to do it, but failure to do so can cause serious problems.
It is also possible that my code is incorrect.
So if you are not confident in your judgment or skills, please consult a Shopify partner or expert.

■ How to remove Disallow for search results from robots.txt

Be sure to check the following:

• https://help.shopify.com/en/manual/promoting-marketing/seo/editing-robots-txt
• https://shopify.dev/themes/seo/robots-txt?shpxid=c28a2c7d-F5D2-4CC2-E558-8F0B35E3611B#remove-a-defau...

Create robots.txt.liquid and add two lines to the original code as follows.

# we use Shopify as our ecommerce platform
{%- comment -%}
# Caution! Please read https://help.shopify.com/en/manual/promoting-marketing/seo/editing-robots-txt before proceeding to make changes to this file.
{% endcomment %}
{% for group in robots.default_groups %}
  {{- group.user_agent -}}

  {% for rule in group.rules %}
    {%- unless rule.directive == 'Disallow' and rule.value == '/search' -%}
      {{- rule -}}
    {%- endunless -%}
  {% endfor %}

  {%- if group.sitemap != blank -%}
    {{ group.sitemap }}
  {%- endif -%}
{% endfor %}

Code part added:

• {%- unless rule.directive == 'Disallow' and rule.value == '/search' -%}
• {%- endunless -%}

■ How to output noindex to necessary pages

As an example, you can summarize the code for noindex in the head tag as follows

{%- liquid
  assign flag_noindex = false
  case request.path
    when '/search'
      assign flag_noindex = true
    when '/collections/vendors'
      if collection.all_products_count == 0
        assign flag_noindex = true
      endif
    endcase
-%}
{% if flag_noindex %}
  <meta name="robots" content="noindex">
{% endif %}

Operating conditions:

• Output noindex in search results (even if there are more than 1 results)
• Output noindex when there are 0 results in vendor

However, if the status code 404 is returned when there are 0 cases on the vendors page, the noindex for the vendors page is not very useful.
As a small possibility, it may serve as a precautionary measure, though.

Just to be sure, check for yourself that the code works as intended!

[JenDeg]

Hi Jizo,

Have just printed this out and will dive into this in the morning as it's after 8pm in California right now. Thank you very much for being so thoughtful and kind to help me. I appreciate it so very much. I'm learning quite a lot through working on this and it's great to know there are solutions to foil these hackers and bots! I'll reply after I get it implemented. ~Jen

地蔵さん、こんにちは。

これを印刷したところです。現在、カリフォルニアでは午後 8 時以降なので、午前中に詳しく説明します。私を助けてくれてとても思慮深く親切にしてくれてありがとう。とても感謝しています。私はこれに取り組むことで多くのことを学んでおり、これらのハッカーやボットを阻止するソリューションがあることを知ってうれしいです!実装したら返信します。 〜ジェン

[Denny10]

I also like the solution of Jizo_Inagaki. You can go to your Google Search Console if you have already used it and go to Index -> Pages. There could be "Indexed, although blocked by robots.txt file" at the bottom. You can click on that, "Show details" and "Review" after you have done what Jizo_Inagaki suggested - this will make the process of deleting those links faster.

Adding the /search to robots.txt again might make you vulnerable for those kind of attacks to. On the other hand, if you don't disallow the search in your robots.txt, it might lead to a waste of crawl budget. If you are not sure whether to do this or not, you can go to Settings -> Crawling Statistics after you have fixed it to have further insights in what the Google Bot is Crawling.

[FreshMarketing]

What about using the removal tool to remove all links with the /collections/vendors prefix for 6 months? Would this mean your site would look 'cleaner' to Google?

Also, the affected site I'm dealing with did have an app installed around the time the issues began so I have deleted that. 

https://search.google.com/search-console/removals 

[jackgenesin]

That would definitely clean the index however i'd consult your Google Analytics data before doing this to make sure that you don't have any vendor URLs actually bringing in traffic and/or sales to your site before you scrap all of them from the index. 

[Notsotechy]

Sorry, probably a very dumb question but the colours of my "robots" and "no index" is black not red and "content" is green. Does this matter?  I'm afraid this is one thing I struggle hugely with! I'm beginning to wish I hadn't looked at my Search Console!

[ElaineClaire]

Hi, Many thanks for this as it really has helped me, when I did not know where to turn. I had this problem on my website and did the suggested fix. The dodgy URL's have dropped away over time, although  I am just concerned that this hack could also be used against the search bar. As I have noticed 2 weird searches from the last week in google search console, showing as indexed but blocked by robots. Could this be possible and if so would I need to add code for this also?  Elaine

[Onebyte]

However, the hack does not solve the problem, it only prevents indexing. Moreover, it is not covered if it is a request.path in another language.

@Shopify: When will you solve the problem to the Vendors Hack finite sustainable?

[Brandy21]

If anyone wants to dig deeper for the person responsible, I spotted this persons handle in spam links and it took me to this page.  Doubt he's the only one responsible - but maybe on hot lead.  I'd do something, but have no idea where to start...

https://telemetr.io/en/channels/1989706247-kunghac/publish

[NEI-Arlene]

I'm having the same issue. I spoke with Shopify and they disregarded saying that it is most likely the themes third party and to contact them. However, when looking at other forums and doing a quick google search there are thousands of Shopify/ Non-Shopify accounts affected. 

This is in fact a malware.
I called my domain company and they did confirm this site was generating malware but due to Shopify's limitations on providing file transfer privileges they could not delete or remove the malware and stated Shopify has to do it. 

I'm contacting Shopify again today to see if anything can be done.  

I understand that entering the following code:

{%- if request.path == '/collections/vendors' and collection.all_products_count == 0 -%}
<meta name="robots" content="noindex">
{%- endif -%}

Will prevent bots from crawling the vendors page but what about the existing malware on everyone's websites? 

Has anyone had any luck having Shopify remove the malware or add extra security measures so this doesn't happen?

 

[OlsenRun]

Hello! I had this issue as well. These pages can be removed from your site's index via Google Search Console.

1. Launch Search Console

2. Select "Indexing" > "Removals"

3. Paste in unwanted URL

4. Hit next

5. Click "Submit Request"

After a few days the URL will be removed from Google's index.

[Notsotechy]

Unfortunately this doesn't remove them permanently, only for a few months then they get re-crawl

ed

[efplico]

I am suffering the same issue. It seems a major security breach. Shopify should act. I saw my organic traffic to decrease significantly, and discovered this in SEMrush. 

[958139]

Shopify are you sleeping? I have same problem. What is the reason? How can we fix healthy which not bad effect our Seo. 

[vader_art]

1. Stop Google from indexing these spam URLs by implementing a 'noindex' meta robots tag, as suggested in the Accepted Solution. Fyi, DO NOT disallow these URLs in the /robots.txt file because Google will never get to the 'noindex' meta tag AND it doesn't stop Google from indexing just the URL anyway.
2. Then request the removal of all URLs starting with '/collections/vendors?q=' from Google's index using Google Search Console.
3. The above will solve the immediate issue but will still leave you with a horrific-looking 'backlink profile' which can get your site penalised in Google anyway. That's why you need to analyse your whole link profile (Google Search Console > Links > Linking Domains is a good starting point), then create a disavow file with all the dodgy linking domains (just Google it to get the right format/sample file) and submit it to Google. Then repeat once a week for a few weeks to catch new offending domains.
4. Finally, complain to Shopify to do something about it! They come up with all sorts of excuses. I've heard it's because of the tag functionality. Or UTMs. But this should be resolved on their end really, especially when they provide service to many small businesses which don't have a clue about this!
5. Bonus: check if the offending URLs don't include '+' symbols. If they do, Shopify's default robots.txt will disallow access to these URLs so your new 'noindex' meta tag will not be read/obeyed by Google on those URLs. It's a very 'smart' move by these spammers, actually. So watch out for these too.

Good luck!

[Trevor]

Hey, everyone. 

Thank you for flagging this issue in the Community. We have raised the issue with our developers for further review. We do not have a timeline on the fix, however, I will provide an update once this has been resolved. 

I would encourage you to view our top related threads on this issue that provide viable workarounds:

• https://community.shopify.com/c/shopify-discussions/website-hacked-help/m-p/1748004
• https://community.shopify.com/c/shopify-discussions/has-my-site-been-hacked/m-p/1722595/highlight/tr...

[Trevor]

Hello, again! 

Our developers have recently shipped a change that will generate a 404 page if the vendor is unknown (based on query string). The change will block it from indexing on Google. These changes will only apply to vendor pages, but our teams will investigate whether other pages may be vulnerable to this abuse.

This change is rolling out platform wide as we speak, so it may take some time for you to see these changes implemented. However, moving forward, this should help mitigate the ability spammers have with taking advantage of the query print out to advertise their spam links. 

[mikstar]

This works - thanks! 🙂

[vader_art]

Great, thank you. A year ago the same thing was happening to '/search?q=' URLs. Not sure if it's still the case.

[Denny10]

That seems to work. Anyway, in our case there are some links, that are blocked by robots.txt, which leads Google not to check the blocked pages for the 404 errors. I'd still do the recommended steps by Vader_art (excluding step 4) to make sure, that everything will be deindexed quickly and correctly.

In our case, we did the following steps additionally:

1. We checked our Search Console for "blocked by robots.txt but still indexed" pages
2. We deleted the following statements in the robots.txt
   Disallow: /collections/*+*
   Disallow: /collections/*%2B*
   Disallow: /collections/*%2b*
   Disallow: /*/collections/*+*
3. We have just clicked "review" in Google Search Console for Google to Check those pages
4. After the check is done successfully, we're going to add the statements to the robots.txt again

[Mark1988]

Hi, in this does the trick to make the pages not show again with a 404 error page:

{%- if request.path == '/collections/vendors' and collection.all_products_count == 0 -%}
<meta name="robots" content="noindex">
{% elsif request.path == '/404' %}
{%- endif -%}

I only believe there is somewhere (in the Theme code) a BOT that is crawling more pages, as i see the Google Search Console get more of these spammy url pages, under not indexed (because they get blocked). If i knew where it was located, then i could delete it. And i think this because multiple people from Asia got acces to the Theme Code before (for Feiverr / Up Work gigs), so i think one of them left this nice little Crawler Bot. Allthough i have no proof for it yet, my gut feeling is saying this.

[Mark1988]

Have also noticed that there are now different Chinese spammy url links starting with below.

These seo spammy backlinks are now being targeted to the 'search bar'. Does anyone has that as well / has noticed? ..../search?q=... Almost all of them are blocked, but a handfull went through and is being indexed. Also have reveived from some gmail name called 'Chris Parker', mentioning the site has errors. But as almost none of this spam is being indexed, this will be ofcourse not searchable or vissible for the people that are searching or visiting the site. So most likely it's the person that runs these BOTS.

https://yourdomain.com/search?q=2%E5%8F%B7%E7%AB%99%E5%A8%B1%E4%B9%90%E5%AE%98%E6%96%B9-%E2%9C%94%EF%B8%8F%E6%8E%92%E5%90%8D%E4%BB%A3%E5%81%9A%E8%AE%BF%E9%97%AE%E2%9E%A1%EF%B8%8Fliuhen.vip%E2%AC%85%EF%B8%8F-%E5%BD%A9%E5%AE%9Dapp%E4%B9%B0%E5%BD%A9%E7%A5%A8%E8%B5%9A%E9%92%B1%E6%98%AF%E7%9C%9F%E7%9A%84%E5%90%97-2%E5%8F%B7%E7%AB%99%E5%A8%B1%E4%B9%90%E5%AE%98%E6%96%B9-2%E5%8F%B7%E7%AB%99%E5%A8%B1%E4%B9%90%E5%AE%98%E6%96%B9-%E2%9C%94%EF%B8%8F%E6%8E%92%E5%90%8D%E4%BB%A3%E5%81%9A%E8%AE%BF%E9%97%AE%E2%9E%A1%EF%B8%8Fliuhen.vip%E2%AC%85%EF%B8%8F-%E5%BD%A9%E5%AE%9Dapp%E4%B9%B0%E5%BD%A9%E7%A5%A8%E8%B5%9A%E9%92%B1%E6%98%AF%E7%9C%9F%E7%9A%84%E5%90%97-2%E5%8F%B7%E7%AB%99%E5%A8%B1%E4%B9%90%E5%AE%98%E6%96%B9

[GregFirebrand]

Has anyone encountered this where the link is an RSS feed? Would Jizo's solution still work in this case?

[Subscents]

Can confirm I have the same issue. Added the code and it works for those particular links.

However, I also have once created like this:

my.domain/collections/all/diablo-4-gems-for-sale,best-store-%E2%9C%94%E2%AD%95%E2%9D%A4x4gm%C2%B7com%E2...etc.

Any thoughts on how to tackle this one - I can't see it in the admin anywhere