2740 not found pages

[helloworld]

What do you make of these in WMT ?

http://www.mydomainname.com.au/click.php?c%3EZoKicnS{eIKieHWofT6kc31vZYV%3E%27lfzxpset%3ECsboe%2CNbobhfnfou%27sbol%3E4%27f%3Ebv%3Cvt%3C5%3A%3C2%3C2%3C67624623%3Cczuftj{f%3C2%3C4136%3Cgsjfoegjoefs%60bdujpo%604%3A1%3C1%2F1113%3Cfbfd2b81g5%3A%3Ab99f61%3A377b1967%3A79g3%27vsm%3Eiuuq%264B%263G%263Ggsjfoegjoefs%2Fdpn%263Ghp%263Gh%3A57519.qdu%264Gbgg%264Eqbslfe%2637uffepgg%264E2421956543%2637vhd%264Ef12975f42cd%3A96c%3Ag16663bg47ce2be7%27zbsht%3Egsjfoegjoefs%2Fdpn


2740 of them.

 

[nt81]

Eh?

 

[FirstPageResults]

What CMS? Could be for tracking unique clicks or something bit it looks malformed.

Does WMT show a referring source??

 

[nt81]

Don't appear to be any type of encoding that I can decode

Could just be a badly configured spam bot.

Would be interesting to see the actual log file. Are you able to get raw logs from your site?

 

[helloworld]

Just having a look through the log file. Suprisingly there doesn't appear to be anything dodgy.

I just googled click.php as I couldn't see anything in the root either and found this http://blog.unmaskparasites.com/2012/05/02/malware-piggybacks-on-automatic-wordpress-updates/

Might work my way through it later.

This particular website/domain has been strugling with its rankings for months. Wondering if this may be the cause or at least partially.

 

[nt81]

If your wordpress template was downloaded for free from a 3rd party templates website, there is about a 90% chance that it has stuff in it that you probably don't want.

I read a blog a couple of months ago and there was a guy who went through heaps of 3rd party "free" Wordpress templates and they were full of base64 encoded stuff that shouldn't have been there or was doing nasty things and hi-jacking sites.

From then on, I only use Wordpress templates which you can download from within Wordpress itself.

 

[helloworld]

Yeah, this was a themeforest theme. Though I am now suspecting a plugin to be the culprit

 

[nt81]

Yep, plugins are the same category if from a 3rd party site.

From what I've seen, Wordpress check the themes and plugins available from Wordpress itself.

 

[James]

Yeah I have seen low quality plugins cause these types of issues in the past. I would re crawl the website with a fresh crawl to ensure these pages are all taken down. Sometimes GWT data can be delayed and show up errors which are fixed, have noticed that a few times.

 

[nt81]

Yep, dealing with a client myself who has just changed hosting provider to get some actual security on his site. We're 99.999% sure our security has ripped all of the offending code out from being rendered. Stupid insecure, 3rd party plugin.

WMT was complaining about it, and now he had re-scanned it multiple times and it is still complaining. I said, wait a week and then check again. Pretty sure you just have to wait on Google to schedule a re-crawl.