unwanted guest page in my blog

Got the same problem, anyone know?

Yes, I’ve got the same problem and when I googled it I landed on this post. Is it some new form of SPAM? Is there any way to deal with that?

it is increasing the number of visit to torture.ml but it has been introduced a new page: mywebsite/www.rapidgator-porn.ga/postxxxxx. Please help!

I’m seeing the same thing in my Analytics.

“/www.torture.ml/reply734539”

I just assumed it was another form of analytics referral spam in attempt to drive traffic to their site. If you go to, “mywebsite/www.rapidgator-porn.ga/postxxxxx” does it actually take you there as a valid page?

Hopefully someone else can come in here and give us a hand, but you are not alone in seeing this.

In my case, it doesn’t take me to the torture page. My 404 page displays.

This might be relevent to our problem: https://www.ohow.co/stop-adult-referral-spam-ga/

I’ve set up that filter, and it does filter it out for the Audience overview stats, but it doesn’t seem to get rid of it in the page list.

I get the feeling this might just be more ghost referral spam, they want us to click on the link and visit their site. Unless someone can say otherwise, from what I understand its harmless to the security of the website, just annoying…

Sadly it sounds as if you have all been hacked.

You need to start working your way through these resources:

• https://codex.www.ads-software.com/FAQ_My_site_was_hacked
• https://www.ads-software.com/support/topic/268083#post-1065779
• https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
• https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

• https://sitecheck.sucuri.net/scanner/
• https://www.unmaskparasites.com/
• https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thanks @eadusseau, this clarifies the problem fully for me. Indeed it looks harmless, but pollutes the stats, however there is a solution suggested in the article which you reffered to.

kmessinger, what leads you to think that? There are no signs of this anywhere on the website it self, and both the scanners you posted, and wordfence come back showing that the site looks to be clean. Looking online, i’ve seen a few others report torture.ml showing up in analyics as well.

For me if there is any reference to a porn site on your site, google, the host server it is a form of a hack and if someone can get in others will also. Never be content to leave crap anywhere on your site.

Try these
https://en.wikipedia.org/wiki/Referer_spam
https://blog.raventools.com/stop-referrer-spam/

It is mostly harmless though is it not? The referrer spam doesn’t actually hit your website, its just spamming the google analytics account doesn’t it? I am fairly new to this, but based on the links you provided, the main threat is to your stats. A clean wordpress installation or backup wouldn’t have any effect on this would it? It just seems to be an impact on the analytics.

I blocked buttons for website dot com by putting in an IP block at the server and on CloudFlare blocked the country of origin.

Right, it is not a hack in that sense but you need to fix it just the same.

Okay, I very much appreciate you taking the time to look into this.

I will take a look at blocking the country of origin using my host. I use dreamhost and not cloudflare, but I assume there will be a similar option.

You can put in an IP block in your .htaccess, but we’ll only block spammers and hackers like that for you here at DreamHost.

I have the same problem
So I’ve downloaded this plugin- Analytics Spam Blocker
It’ll add some updates to your .htaccess file.
Enabled it.
Copy the contents of the file, then disable it.
Then go back and manually update the file with the sites you wish to block.
Save and that should be you.
If you leave it enabled, then updates to it will wipe off any changes you make.
So far, it’s stopped the rouge entries reoccuring in my analytics.
If you get any new ones, then just add them as new lines to thie htaccess file and you should be good to go.