I found these proxy links on Google Search Console, how do I get rid of them, e.g. proxy.php?link=https://azilob.site

Sort by date Sort by votes
JustinHawk said:
You can do that by using this addon : https://xenforo.com/community/resources/post-content-find-replace.1549/
Click to expand...
These are backlinks to his site. These are from when other sites link to the site, and use the proxy.php file to redirect to the other "dodgy" site on the end of the URL.

Code: 
realmuscleforum.com:185.191.171.3 - - [11/Jan/2024:13:35:45 +0000] "GET /proxy.php?link=http%3A%2F%2Fwdw360.com%2Fproxy.php%3Flink%3Dhttp%3A%2F%2Fgo.clickview.site HTTP/1.1" 200 21824 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.4 - - [11/Jan/2024:13:36:29 +0000] "GET /proxy.php?link=http%3A%2F%2F9fr.old.flirt.sgs51.ru%2Fru%2Fexternal-redirect%3Flink%3Dhttp%3A%2F%2Floanadvisoronline.com%2Flenders%2Fmortgage-investors-corporation-ratings-reviews%2F HTTP/1.1" 200 22093 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:60.12.37.136 - - [11/Jan/2024:13:39:08 +0000] "GET /proxy.php?link=https://datadaily.ru/world/2017/11/chto-my-bydem-delat-esli-s-nami-sviajytsia-inoplanetiane.html HTTP/1.0" 200 21912 "https://ortice.ru:443/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%3A%2F%2Fdatadaily.ru%2Fworld%2F2017%2F11%2Fchto-my-bydem-delat-esli-s-nami-sviajytsia-inoplanetiane.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15"
realmuscleforum.com:92.60.38.114 - - [11/Jan/2024:13:41:07 +0000] "GET /proxy.php?link=http%3A%2F%2Fabono.ru%2Fbitrix%2Fredirect.php%3Fgoto%3Dhttp%253A%252F%252Falt1.toolbarqueries.google.tk%252Furl%253Fq%253Dhttps%253A%252F%252Fwww.mpi-corporation.com%252Fprobecard%252Ffcb-probe-card%252F HTTP/1.0" 200 22129 "https://pinskidvorik.by/bitrix/redirect.php?goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttp%253A%252F%252Fabono.ru%252Fbitrix%252Fredirect.php%253Fgoto%253Dhttp%25253A%25252F%25252Falt1.toolbarqueries.google.tk%25252Furl%25253Fq%25253Dhttps%25253A%25252F%25252Fwww.mpi-corporation.com%25252Fprobecard%25252Ffcb-probe-card%25252F" "Mozilla/5.0 (Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:185.191.171.11 - - [11/Jan/2024:13:43:55 +0000] "GET /proxy.php?link=https%3A%2F%2Fszryap.zombeek.cz HTTP/1.1" 200 21712 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:153.101.67.170 - - [11/Jan/2024:13:44:27 +0000] "GET /proxy.php?link=https%3A%2F%2Fwww.ligra.cloud%2Fapp%2Fzoocat_image.php%3Furl_pdf%3DaHR0cHM6Ly93d3cuZGlnaXRhbGpvdXJuYWwuY29tL3ByL25ld3MvZ2V0bmV3cy9kZWNvZGluZy10aGUtY3J5cHRvLXdvcmxkLWFuLWV4Y2x1c2l2ZS1pbnRlcnZpZXctd2l0aC1zb3BoaWEtbG9lcGV6LXRoZS12aXNpb25hcnktYmVoaW5kLWNyeXB0b3BoaWE%26type%3Dpdf HTTP/1.0" 200 22413 "http://forums.spacewars.com/proxy.php?link=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%253A%252F%252Fwww.ligra.cloud%252Fapp%252Fzoocat_image.php%253Furl_pdf%253DaHR0cHM6Ly93d3cuZGlnaXRhbGpvdXJuYWwuY29tL3ByL25ld3MvZ2V0bmV3cy9kZWNvZGluZy10aGUtY3J5cHRvLXdvcmxkLWFuLWV4Y2x1c2l2ZS1pbnRlcnZpZXctd2l0aC1zb3BoaWEtbG9lcGV6LXRoZS12aXNpb25hcnktYmVoaW5kLWNyeXB0b3BoaWE%2526type%253Dpdf" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:20.219.137.240 - - [11/Jan/2024:13:44:41 +0000] "GET /proxy.php?link=https://online88media.com/5-zodiac-signs/ HTTP/1.0" 200 21741 "https://airportbaikal.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%3A%2F%2Fonline88media.com%2F5-zodiac-signs%2F" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:185.191.171.5 - - [11/Jan/2024:13:45:58 +0000] "GET /proxy.php?link=http%3A%2F%2Fartistecard.com%2Fsaturdaybmm89 HTTP/1.1" 200 21753 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.16 - - [11/Jan/2024:13:46:55 +0000] "GET /proxy.php?link=http%3A%2F%2Fandroidos-top.com%2Flifestyle%2F12853-download-almaz-sinema-unlocked-mod-for-android.html HTTP/1.1" 200 21917 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.19 - - [11/Jan/2024:13:50:07 +0000] "GET /proxy.php?link=http%3A%2F%2Fww17.nikissweetside.com%2F__media__%2Fjs%2Fnetsoltrademark.php%3Fd%3Dcryptomoon.site HTTP/1.1" 200 21896 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:164.152.17.14 - - [11/Jan/2024:13:50:27 +0000] "GET /proxy.php?link=http%3A%2F%2Flocalhandymansydney.com.au.assetline.com%2F__media__%2Fjs%2Fnetsoltrademark.php%3Fd%3Dwww.responsinator.com%252F%253Furl%253Dhttps%253A%252F%252Fv.gd%252Fcrystal_cruises_2022_29377 HTTP/1.0" 200 22157 "https://mb1.ru/bitrix/redirect.php?goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttp%253A%252F%252Flocalhandymansydney.com.au.assetline.com%252F__media__%252Fjs%252Fnetsoltrademark.php%253Fd%253Dwww.responsinator.com%25252F%25253Furl%25253Dhttps%25253A%25252F%25252Fv.gd%25252Fcrystal_cruises_2022_29377" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71"
realmuscleforum.com:85.208.96.197 - - [11/Jan/2024:13:54:09 +0000] "GET /proxy.php?link=http%3A%2F%2Fandroid-hack.mobi%2Fpuzzle%2F HTTP/1.1" 200 21737 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"

I've seen a lot of this on XF1 with proxy.php.

Hugh Edwards

XF 1.4 Thread 'External Redirect / Porn Spamming?'

Hello.

We've noticed that we are getting loads (and I mean loads!) of backlinks from porn sites recently and they seem to be using our External Redirect proxy to do it. I don't know why or how....here is an example:

https://www.gravyforthebrain.com/xenforo/proxy.php?link=http://2beeg.mobi

This happens even if users are not logged in. Is there any way I can stop this external redirect from working/happening, and has anyone else seen anything like this? We've done a malware search but come up with nothing, and in the above example, '2beeg' doesn't appear anywhere in our db...
 
Upvote 0 Downvote
MattW said:
These are backlinks to his site. These are from when other sites link to the site, and use the proxy.php file to redirect to the other "dodgy" site on the end of the URL.

Code: 
realmuscleforum.com:185.191.171.3 - - [11/Jan/2024:13:35:45 +0000] "GET /proxy.php?link=http%3A%2F%2Fwdw360.com%2Fproxy.php%3Flink%3Dhttp%3A%2F%2Fgo.clickview.site HTTP/1.1" 200 21824 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.4 - - [11/Jan/2024:13:36:29 +0000] "GET /proxy.php?link=http%3A%2F%2F9fr.old.flirt.sgs51.ru%2Fru%2Fexternal-redirect%3Flink%3Dhttp%3A%2F%2Floanadvisoronline.com%2Flenders%2Fmortgage-investors-corporation-ratings-reviews%2F HTTP/1.1" 200 22093 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:60.12.37.136 - - [11/Jan/2024:13:39:08 +0000] "GET /proxy.php?link=https://datadaily.ru/world/2017/11/chto-my-bydem-delat-esli-s-nami-sviajytsia-inoplanetiane.html HTTP/1.0" 200 21912 "https://ortice.ru:443/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%3A%2F%2Fdatadaily.ru%2Fworld%2F2017%2F11%2Fchto-my-bydem-delat-esli-s-nami-sviajytsia-inoplanetiane.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15"
realmuscleforum.com:92.60.38.114 - - [11/Jan/2024:13:41:07 +0000] "GET /proxy.php?link=http%3A%2F%2Fabono.ru%2Fbitrix%2Fredirect.php%3Fgoto%3Dhttp%253A%252F%252Falt1.toolbarqueries.google.tk%252Furl%253Fq%253Dhttps%253A%252F%252Fwww.mpi-corporation.com%252Fprobecard%252Ffcb-probe-card%252F HTTP/1.0" 200 22129 "https://pinskidvorik.by/bitrix/redirect.php?goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttp%253A%252F%252Fabono.ru%252Fbitrix%252Fredirect.php%253Fgoto%253Dhttp%25253A%25252F%25252Falt1.toolbarqueries.google.tk%25252Furl%25253Fq%25253Dhttps%25253A%25252F%25252Fwww.mpi-corporation.com%25252Fprobecard%25252Ffcb-probe-card%25252F" "Mozilla/5.0 (Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:185.191.171.11 - - [11/Jan/2024:13:43:55 +0000] "GET /proxy.php?link=https%3A%2F%2Fszryap.zombeek.cz HTTP/1.1" 200 21712 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:153.101.67.170 - - [11/Jan/2024:13:44:27 +0000] "GET /proxy.php?link=https%3A%2F%2Fwww.ligra.cloud%2Fapp%2Fzoocat_image.php%3Furl_pdf%3DaHR0cHM6Ly93d3cuZGlnaXRhbGpvdXJuYWwuY29tL3ByL25ld3MvZ2V0bmV3cy9kZWNvZGluZy10aGUtY3J5cHRvLXdvcmxkLWFuLWV4Y2x1c2l2ZS1pbnRlcnZpZXctd2l0aC1zb3BoaWEtbG9lcGV6LXRoZS12aXNpb25hcnktYmVoaW5kLWNyeXB0b3BoaWE%26type%3Dpdf HTTP/1.0" 200 22413 "http://forums.spacewars.com/proxy.php?link=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%253A%252F%252Fwww.ligra.cloud%252Fapp%252Fzoocat_image.php%253Furl_pdf%253DaHR0cHM6Ly93d3cuZGlnaXRhbGpvdXJuYWwuY29tL3ByL25ld3MvZ2V0bmV3cy9kZWNvZGluZy10aGUtY3J5cHRvLXdvcmxkLWFuLWV4Y2x1c2l2ZS1pbnRlcnZpZXctd2l0aC1zb3BoaWEtbG9lcGV6LXRoZS12aXNpb25hcnktYmVoaW5kLWNyeXB0b3BoaWE%2526type%253Dpdf" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:20.219.137.240 - - [11/Jan/2024:13:44:41 +0000] "GET /proxy.php?link=https://online88media.com/5-zodiac-signs/ HTTP/1.0" 200 21741 "https://airportbaikal.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttps%3A%2F%2Fonline88media.com%2F5-zodiac-signs%2F" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0"
realmuscleforum.com:185.191.171.5 - - [11/Jan/2024:13:45:58 +0000] "GET /proxy.php?link=http%3A%2F%2Fartistecard.com%2Fsaturdaybmm89 HTTP/1.1" 200 21753 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.16 - - [11/Jan/2024:13:46:55 +0000] "GET /proxy.php?link=http%3A%2F%2Fandroidos-top.com%2Flifestyle%2F12853-download-almaz-sinema-unlocked-mod-for-android.html HTTP/1.1" 200 21917 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:185.191.171.19 - - [11/Jan/2024:13:50:07 +0000] "GET /proxy.php?link=http%3A%2F%2Fww17.nikissweetside.com%2F__media__%2Fjs%2Fnetsoltrademark.php%3Fd%3Dcryptomoon.site HTTP/1.1" 200 21896 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
realmuscleforum.com:164.152.17.14 - - [11/Jan/2024:13:50:27 +0000] "GET /proxy.php?link=http%3A%2F%2Flocalhandymansydney.com.au.assetline.com%2F__media__%2Fjs%2Fnetsoltrademark.php%3Fd%3Dwww.responsinator.com%252F%253Furl%253Dhttps%253A%252F%252Fv.gd%252Fcrystal_cruises_2022_29377 HTTP/1.0" 200 22157 "https://mb1.ru/bitrix/redirect.php?goto=https%3A%2F%2Fwww.realmuscleforum.com%2Fproxy.php%3Flink%3Dhttp%253A%252F%252Flocalhandymansydney.com.au.assetline.com%252F__media__%252Fjs%252Fnetsoltrademark.php%253Fd%253Dwww.responsinator.com%25252F%25253Furl%25253Dhttps%25253A%25252F%25252Fv.gd%25252Fcrystal_cruises_2022_29377" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71"
realmuscleforum.com:85.208.96.197 - - [11/Jan/2024:13:54:09 +0000] "GET /proxy.php?link=http%3A%2F%2Fandroid-hack.mobi%2Fpuzzle%2F HTTP/1.1" 200 21737 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"

I've seen a lot of this on XF1 with proxy.php.

Hugh Edwards

XF 1.4 Thread 'External Redirect / Porn Spamming?'

Hello.

We've noticed that we are getting loads (and I mean loads!) of backlinks from porn sites recently and they seem to be using our External Redirect proxy to do it. I don't know why or how....here is an example:

https://www.gravyforthebrain.com/xenforo/proxy.php?link=http://2beeg.mobi

This happens even if users are not logged in. Is there any way I can stop this external redirect from working/happening, and has anyone else seen anything like this? We've done a malware search but come up with nothing, and in the above example, '2beeg' doesn't appear anywhere in our db...
Click to expand...
Aha my bad, I didn't actually read complete title. He was asking for Google search console.

Well I think one can easily block proxy.php in robots.txt, so that Google doesn't index it. And if you want to remove those urls that are already indexed, you can do that from removal section under indexing.
 
Upvote 0 Downvote
Thanks for all of your help - those proxy redirects were indexed on Google so I removed them using Google Search Console. I also changed the redirect code in Xenforo - a misspelling was highlighted on another thread, nowfollow instead of nofollow.

Google removes these links from indexing for six months, and then they will be reslisted if they are recreated at the next indexing. As they shouldnt be recreated I should be fine. Is that correct?
 
Upvote 0 Downvote
PhobiaForum said:
Google removes these links from indexing for six months, and then they will be reslisted if they are recreated at the next indexing. As they shouldnt be recreated I should be fine. Is that correct?
Click to expand...
You can block proxy links via robots.txt file, that way they will never get listed again in Google index.
 
Upvote 0 Downvote
Hi,

There are 60k dodgy proxy pages listed on Google for my other forum:-

I've changed the robots.txt file so proxy.php pages aren't indexed from now on. I've deleted the 10 or so that were listed on the Google Search Console. Whats the best way to try and identify the malicious code they are using to do this and get rid of the rest.
 
Last edited:
Upvote 0 Downvote
PhobiaForum said:
I've changed the robots.txt file so proxy.php pages aren't indexed from now on. I've deleted the 10 or so that were listed on the Google Search Console. Whats the best way to try and identify the malicious code they are using to do this and get rid of the rest.
Click to expand...
Monitor your site logs and block! We also used the similar approach :)

quimerics said:
How i can do that?
Click to expand...
In your robots.txt file.

Code: 
User-agent: *
Disallow: /proxy.php
 
Upvote 0 Downvote
JustinHawk said:
Monitor your site logs and block! We also used the similar approach :)


In your robots.txt file.

Code: 
User-agent: *
Disallow: /proxy.php
Click to expand...
How do you block the proxy links?

I presume the robots.txt command and deindexing all files with xxxx/proxy.php should soon delete them from Google lisitng. Just want to make sure they dont emerge again.

I also corrected the type on Xenforo one; a page had nowfollow instead of nofollow.
 
Upvote 0 Downvote
Don't forget disabling proxy.php does leave your site exposed in certain situations. The proxy is there for a reason.

MySiteGuy

XF 2.2 Post in thread 'proxy.php using a lot of resources'

If the features are turned on in the admin panel:

1. proxy.php fetches images people place in their posts. I'm not referring to the user uploading images, but instead when they put the image URL in their post. The proxy stores them on the local server. If you set the proxy cache to never expire, it insures the image is available if it's deleted from the other site. It keeps the other site from seeing your visitor's IP addresses when they view these posts.

2. proxy.php also allows you to proxy links. If a user places a non-image link in their post, when other users click this link instead...
  • Like
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

Joeychgo
  • Solved
XF 2.2 How do I get rid of this "New Thread" box at the top of each forum?
Replies
3
Views
494
AndyB
AndyB
Alpha1
  • Question Question
RM 2.1 How do I get rid of the cog icon on all my documents?
Replies
4
Views
669
Alpha1
Alpha1
Back
Top Bottom