Very strange people are linking to me

[CuriousChris]

I was checking my stats and noticed a whole lot of new links. They all seem to be from Russia with the .ru extention.
Also when I go check them Malwarebytes tells me they've blocked a "potentially malicious" site.
What is happening?
Why are they linking to me?
When I look at the page "linked" there is no link that I can find.
help
Christine

[farcaster]

Are you running a Wordpress site or another CMS?

Also, exactly what are you looking at for the stats. If it's just page visits, then you are likely seeing bot's crawling your site looking for known flaws in the code to get in and inject their stuff. If your site(s) are clean, then don't worry about it. There are ways to block this activity, but I don't remember how at this minute. Maybe someone else could jump in, if that's the case.

[CuriousChris]

Hi Farcaster

I check the stats to see what pages are most successful. I also check who is linking to me.
I don't use any CMS, I write html using notepad.
The only script I use is a simple javascript to show the date.
What benefit can these .ru links be to them?
Christine

[poofinger]

Are they linking to your homepage or strange urls on your domain? Linking to you in itself doesn't matter, but if they are linking to urls that you don't recognize as being part of your site this would indicate that you have been hacked.

[CuriousChris]

I've not been hacked. I don't have particularly strange pages on my domain.
I have a bunch of russian sites that link to me. They are garbage sites like casinos and such mostly.
I don't understand why they are doing this. I have nothing to do with their subjects.
I've been gradually blocking their URL from my site and there seems to only be a few ip addresses, or rather lots of ip addresses but ranges of IP rather than different servers.
I'm curious what the benefit is to them. They are not hotlinking to photos that I can see.

[poofinger]

If they are linking to your home page or inner pages, I have read that there is a suspected benefit in SEO to linking to authority websites. Whether this is true or not I have no idea. I have had links from European websites to one on my websites, but the URLs they linked to didn't seem to exist. It was only after some investigation that I fund that I had been hacked.

[CuriousChris]

How had you been hacked? How did you find out?
I read that it is usually done through a script.
I only run a short JS to put the date on my pages.
All my coding is done by hand and there is not much chance to insert nasty stuff.

[rockstrongo]

How had you been hacked? How did you find out?
I read that it is usually done through a script.
I only run a short JS to put the date on my pages.
All my coding is done by hand and there is not much chance to insert nasty stuff.

Chris, check at the very bottom of your pages for a really long string that doesn't look like it should be there. If you open it in notepad and turn on wordwrap it will be easier to locate. I have had that issue before and that is where they stashed their code. Another think you can do is download you entire site, define it in Dreamweaver (if you don't have DW, download Notepad++). Once the site is downloaded, do a search for the entire local site for ".ru". This will find anything that is pulling that information. Delete it, change your passwords, and try it again.

Also, there are a lot of security companies out there that will block all countries you don't want accessing your website. As of 2 weeks ago, I am only allowing people from the U.S. and Canada to even know my site exists since those are the only places I ship and the only people I do development for. You can also use .htaccess to block Russia and other countries notorious for spamming, malware, and just being d-bags. I hope this was useful and good luck.

[CuriousChris]

Thanks for the information. I will check this.
hackers suck!

[azbruno]

I just found the same thing on my site. About the middle of August I started getting links to one specific page on my site from lots of different .ru address. I checked a couple of those pages (with all scripting and cookies blocked), but could find nothing there referencing my site.

My site has absolutely no scripts... just pure HTML. I changed the name of the one page that was being linked to so I'll watch to see if that helps. Unfortunately, I deleted the old page without looking at it as suggested above.