Weird Text showing on Google search

[nlinecomputers]

Ha! I looked it up on Urban Dictionary because I didn't know what it meant. They have a different definition.

http://www.urbandictionary.com/define.php?term=HSW

LOL

 

[RockIT Man]

LOL

I was thinking: "Well... that escalated quickly!"

 

[Markverhyden]

It only shows up on some sub-pages so that makes me think there is some common code or config issue with those pages that is missing in the others. I'd compare a sub-page that does not have it to one that does to see if anything stands out.

 

[Mick]

I was thinking: "Well... that escalated quickly!"

Oh - please! Even if I thought that, I'd never say it

However: I'm now thinking malware, despite what's been said. Reason is, I went to cache:cantabsrowing.org.uk and had a look at that. The page is covered with links to God-knows-what! None of this is showing in the actual page itself, either visually or in the code. Nevertheless, Mark makes a fair point, which I shall check out.

 

[Moltuae]

It's most likely a spammy WP plugin (or malware).

If I examine a page source normally it's not there. If I masquerade as Googlebot (2.1), it is:

 

[Mick]

Thanks, @Moltuae - that's exactly what I get too. Site is scanning clean of malware and the ISP reports no instances of an attack, so I'm drawn to the idea of an iffy plug-in, even though no new ones have been installed for months. Thanks for the input.

 

[Moltuae]

Depending on the site's popularity, it can take Google weeks/months to index new content and this may have been present in search results for some time before it was noticed.

I would check for recently updated plugins too. I had a similar issue once with a previously legit plugin that turned rogue after an update.

 

[Mick]

Drat! I just deactivated all plug-ins, and it made no difference Guess I need to keep looking...

 

[purdybread]

You mentioned wordfence? Free or paid? I think the free one is a month behind on latest updates.

 

[Mick]

Yeah - this is the free one. I've also tried Sucuri and Bullet Proof Security scans - not coming up with anything...

 

[Moltuae]

Drat! I just deactivated all plug-ins, and it made no difference Guess I need to keep looking...

Rather than simply deactivating them, try moving them from the wp-content/plugins folder. It's possible something in there is still active.

Edit: Also try switching themes and deleting any unused themes.

 

[Mick]

@Moltuae. Thanks - sorry, I should have said: Moving the plug-ins is my way of deactivating them I also tried changing themes, but no luck. I've now referred the whole sorry business back to the ISP, on the grounds that I've done pretty much all I can think of - although not with any great expectations!

 

[Moltuae]

Hmmm. If it's not a plugin, it's possible something has modified the WP files and/or the database. You could try searching the DB for some of the spammy words or just browse it for anything suspicious. To eliminate the possibility of modified WP files, you could remove the existing WP site (or move the files into a folder) and install a new clean copy of WP, pointing it to the existing DB. If that resolves it, re-install the plugins one-by-one.

 

[Mick]

Good idea. I'll need to do it maybe over the weekend, when the site is not in so much use. If I ever sort this out, I'll post back here - meantime, grateful thanks to all who have contributed.

 

[RockIT Man]

This may be of some use: https://support.google.com/webmasters/answer/3311329?hl=en

 

[Markverhyden]

I think it's got to be something going on with Google itself. I tried the search at google.fr and also got the Arabic script. Went to changedetection.com and diffed two google.co.uk result page links, the How to Join Us and Juniors. How to shows Arabic in the google results but Juniors does not. Both actually show Arabic script in the changedetection.com results. What also interesting is that the Arabic, for the most part seems to be attached to imbedded pics and the beginning of each paragraph.

 

[RockIT Man]

I think it's got to be something going on with Google itself.

OP mentioned that it is happening with Yahoo and Bing as well. The text is being hidden from normal browsers and shown to searchbot user agents.

EDIT: @Markverhyden, what's in the .zip file?

My thinking has changed a bit since the beginning. I'm thinking either the links that are being injected are malicious or this is some sort of black-hat SEO tactic trying to get these sites ranked higher.

 

[Markverhyden]

OP mentioned that it is happening with Yahoo and Bing as well. The text is being hidden from normal browsers and shown to searchbot user agents.

EDIT: @Markverhyden, what's in the .zip file?

My thinking has changed a bit since the beginning. I'm thinking either the links that are being injected are malicious or this is some sort of black-hat SEO tactic trying to get these sites ranked higher.

Ahh, good point. Forgot about that. The zip file is the saved webpage of the changedetection.com diff between How to Join and Juniors pages. Be aware that the spammy hyperlinks do work.

 

[Moltuae]

OP mentioned that it is happening with Yahoo and Bing as well.

Also it seems to be something on the site that is detecting whether the visitor is human or a search engine bot. If you masquerade as GoogleBot (I use User Agent Switcher) the spammy links are present. Without it they disappear.

 

[AML]

Maybe they fixed it I just tried no problems