And it is obviously spam, those URLs promote some betting websites and other stuff, I am mad.
I have no idea how that happened and how to prevent it further.
My question is how can I remove those pages? My domain company says it is not their fault and has nothing to do with them since the pages are stored on the Shopify servers.
I have found about them thankfully to Google Search console.
The problem is, that many shops have not excluded Vendor pages from being indexed in Google and with a bit of scripting attackers can inject content on those pages - and get them indexed in Google!
Many webshops have been hidden by this.
You can test your own site by doing a google search in this format: “inurl:yourdomain/collections/vendors” look closely at the results!
You can, however, easily remove the problem by adding this code to your theme.liquid fil:
{%- if request.path contains ‘/collections/vendors’ and collection.all_products_count == 0 -%}
{%- endif -%}
Also, I recommend you exclude the entire vendors category in Google Search Console if you do not actively use it.