[Original] Traffic Anomaly - Solution to Abnormal Baidu Indexing Keywords Caused by Malware Injection (Virtual Hosting)
Published: 2023-05-16
I. Abnormal phenomenon: Traffic suddenly surges, reaching several times or even dozens of times the usual traffic. In most cases, the website is suspended due to traffic overage.
II. Troubleshooting causes:
1. First, analyze the web logs: the number of visits has increased significantly, by multiple times or dozens of times; the pages visited are different; the visiting IPs are scattered and not fixed, but most of the traffic comes from Baidu search, as shown below:
2. Next, analyze the "access statistics": first, you can see that the traffic differs greatly between the days before and after; second, you can find many abnormal records in the search engine keywords, which are not keywords of this website, as shown below:
3. Third-party seo analysis: Enter the domain name at https://seo.chinaz.com/ to query. A large number of abnormal keywords are indexed, and their ranking, indexed volume, and index are all very high. Further verify these keywords by searching on Baidu; clicking them can normally redirect to the website and bring abnormal traffic.
4. Website program code analysis: check the homepage, core files, configuration files, recently modified files, etc., find the malicious code, and remove it completely. Refer to: https://www.west.cn/faq/list.asp?unid=2491
III. Solution
1. First find the malicious files and thoroughly clean up the relevant malicious content.
2. Next, recharge traffic, upgrade to a higher-level virtual host, or upgrade to a cloud server to ensure the website can be accessed normally.
3. Since the keywords have already been indexed, it will take some time for the abnormal keywords to decrease until they disappear. After handling, some abnormal traffic may still occur, so you need to continuously monitor website traffic usage (recharge traffic or upgrade to ensure the website can be accessed normally).
How to quickly find and filter suspected malicious/backdoor files on a cloud server
Website traffic overage troubleshooting