I recently received dark-web exposure alerts for my email and have also noticed several unauthorized purchases, so I've been tightening security across my accounts. This morning, I received Google Search Console emails about a new user and new AMP issues for each of my three domains: my main site, an older site that redirects to it, and a separate merchandise site.
Search Console currently shows only my account, and the user history doesn't list anyone else. I also don't see any unfamiliar authorization tokens, but there are new, unrecognized links under the AMP section. Since all three domains were affected around the same time, I'm concerned that the problem may involve a shared hosting, registrar, DNS, FTP, or database account rather than Search Console itself.
What should I check first, and how can I determine whether the sites or their infrastructure were compromised? I'd also appreciate advice on safely cleaning up any malicious files or settings and securing all three domains afterward.
3 Answers
A missing user in the current Search Console list doesn’t prove nothing happened. An account could have been removed afterward, or the alert could have been triggered by another type of property or verification change. Treat the AMP alerts as a symptom and inspect the sites themselves, especially old themes, plugins, uploads, redirects, and files with unusual timestamps or names.
Don’t limit the investigation to Search Console. Since all three domains changed at once, check the hosting account, registrar, DNS provider, FTP/SFTP accounts, databases, and any shared control panels. Review account login history and audit logs if available. Also verify that the links in the notification emails point to the real Google domain rather than a phishing page.
One domain showing DNS records while the others don’t necessarily means the others are safe. DNS may be managed by different providers or displayed in different places, so verify the authoritative nameservers and records for each domain directly.
Because you’ve also seen account alerts and unauthorized purchases, secure the broader environment immediately. Change passwords from a known-clean device for email, hosting, registrar, DNS, databases, FTP, and payment accounts; use unique passwords and enable multifactor authentication. Revoke active sessions, API keys, app passwords, and recovery methods you don’t recognize. Ask your host or a qualified incident-response professional to scan and isolate the sites before making major changes.
Check your host’s malware scanner and server logs, and compare the site files with clean backups or the original application files. Look for unexpected PHP files, modified configuration files, unfamiliar admin accounts, and suspicious scheduled tasks. Don’t delete evidence before making a backup for review.