How do I delete hacker inserted pages that dont appear on my dashboard?

Two pages have appeared in my Google Search Console, they are blocked by Robot.txt but can I delete them permanently. They are not evident from my dashboard. My website is https://bioproducts.com.au/

the offending pages are:

https://bioproducts.com.au/collections/vendors?q=visit+cheapfifa23coins.com+30%25+off+code%3Afifa2023%7C+excellent+service%2C+easy+to+use+for++fifa+23+ultimate+team+coins+in+bosnia+and+herzegovina%21..++y6em

https://bioproducts.com.au/collections/vendors?q=visit+cheapfifa23coins.com+30%25+off+code%3Afifa2023%7C+outstanding+experience%2C+.extremely+quick+and+professional+for++coins+fifa+23+ps5+in+belgium%21..++z77f

This is really bizarre!

Can you check your collections and see if there is anything in there without any products? It seems like this is simply a description for a collection.

You may want to double check your user permissions, who has access to the store, and I’d also want to double check the apps that you have installed, check their reviews to make sure other people aren’t having the same issues.

Thanks for responding Tristram. It really is bizarre! I have checked all our collections, they all have products in them. We dont have a collection called Vendors We don’t even have a Vendors page, we do have a Stockists page.

The weird thing is that without a link the pages will never be found. Google has them as: indexed, though blocked by Robots.txt We would not have found out about them if we weren’t using Google Search Console to try and improve the site performance.

I am the only person who works on this site, the only other person with permission doesn’t have the skillset to do more than edit text typos :slightly_smiling_face:

There are no apps installed, its a straight Shopify theme.

It does make you wonder how many other shopify sites are being hijacked!

Upon further investigation, It looks to be just a query string, which shopify has “noindex” on those pages, but technically it did exist at one point in time. If you have google search console, then you are able to remove those links. But the noindex shouldn’t have them show to the general public in search results as being associated with your store.

Thanks for raising this I have found the same via search console.
The collection/vendors for countless shopify sites has text in about a website called “zhanbu88.com” - if you google that (with quote marks) you will see 5M+results

Dear @Doris3D

Have you got the solution of this problem now? as we are also facing the similar issue on our website.

https://otovon.in/collections/all/hacking-online-sites,%E2%AD%95my

Spammer has inserted the pages under All products, while we are not able to find such collections in the store. I am the only user for this and no one is permitted.

Please help me.