Treat an unfamiliar indexed URL as an incident clue.
Website compromises do not always deface the homepage. Attackers may add files, conditional redirects or search-only spam while the normal site still appears healthy to its owner.
- Primary outcome
- Faster verification without destroying useful evidence
- Delivery
- Observation, containment and escalation guidance
- Coverage
- Dubai and the UAE
The visible website can look normal while search results tell a different story.
KaizenDubai investigated its own domain after Search Console reported unfamiliar URLs under a /video/ path. Those pages were unrelated to the company and used spam filenames in several languages. The legitimate homepage continued to load, which is why a visual check alone would not have found the issue. Search reporting, server files and HTTP responses had to be compared.
An unfamiliar URL is not proof of the attack method. It may represent an active file, an old indexed path, a cache, a redirect, a compromised application or a server-level change. Start by recording what the search engine saw and what the server returns now. That distinction prevents a cleanup team from deleting evidence or assuming the entry point before logs and access history are reviewed.
Look across search, server, accounts and visitor behaviour.
One signal can have an innocent explanation. Several connected signals justify immediate containment.
- Unknown URLs in Search ConsolePages, parameters, directories or languages appear that nobody on the publishing team created.
- Search snippets unrelated to the businessA site: query or performance export shows gambling, adult, pharmaceutical or counterfeit-product terms.
- Conditional redirectsVisitors from search, mobile devices or certain countries are redirected while direct desktop visits remain normal.
- Unexpected server filesNew scripts, archives, hidden files, altered configuration or recently modified templates appear outside a planned deployment.
- Administrator-account changesUnknown users, changed recovery details, unfamiliar API keys or successful logins from unusual locations appear.
- Outbound traffic or resource spikesHosting logs show mail, CPU, bandwidth or requests that do not match normal website use.
- Security warningsBrowsers, Search Console, hosting systems or endpoint tools identify malicious content, phishing or unsafe downloads.
- Checksums or deployments no longer matchThe live files differ from the known repository or clean backup without an approved change record.
Confirm the symptom without overwriting the scene.
The first hour should establish facts, reduce exposure and preserve the records needed to find persistence.
| Check | Record | Avoid |
|---|---|---|
| Search evidence | URL, query, screenshot, first-seen date and Search Console source | Assuming an indexed result proves the file is still live |
| HTTP behaviour | Status, redirect chain, headers and differences by user agent | Browsing repeatedly from ordinary staff devices |
| Server state | File list, modification time, account activity and relevant logs | Bulk deletion before a forensic copy or clean baseline exists |
| Publishing access | Hosting, SFTP, CMS, deployment and DNS accounts | Changing one password while leaving tokens and other sessions active |
| Business exposure | Affected service, data, users and third parties | Treating the event only as an SEO problem |
Move from suspicion to controlled containment.
The correct action depends on access and impact, but the sequence should preserve evidence and prevent silent re-entry.
- 01
Open an incident record
Record the first observation, affected URLs, systems, contacts and every change made during response.
- 02
Restrict compromised access
Rotate relevant credentials, revoke sessions and tokens, and verify MFA and recovery channels from a trusted device.
- 03
Preserve logs and a server copy
Retain hosting, application, authentication and deployment evidence before removing malicious content.
- 04
Remove the malicious state
Restore or rebuild from a trusted baseline, close the entry point and inspect for persistence beyond the visible files.
- 05
Return truthful HTTP responses
Use 410 or 404 for permanently removed spam URLs and 301 only where a genuine equivalent page exists.
Start with the environment you have.
Share the operational problem, the affected users or sites, and what has already been tried. We will recommend the smallest sensible next step.
