I recently received alerts from a credit-monitoring service saying that my email appeared on the dark web, and I've also noticed several unauthorized purchases. I've been adding extra security to my accounts, but this morning I received six alerts from Google Search Console: a "new user added" notification and a "new AMP issues detected" notification for each of my three domains.
When I checked Search Console, I could only see my own account, and the user history did not show any unfamiliar users. However, there are new, unrecognized links listed in the AMP section, and I don't see any unauthorized user tokens.
The three domains are my main website, an older version that redirects to it, and a separate merchandise site. Since all three were affected at once, I'm concerned that the problem may involve shared hosting, the registrar, DNS, or another account rather than Search Console itself. What should I check first, and how can I determine whether the websites or related accounts were compromised?
3 Answers
First verify that the Search Console emails were genuine by checking their headers and opening Search Console directly rather than using the email links. Regardless, change passwords from a clean device for your email, registrar, hosting, database, DNS provider, FTP/SFTP, and CMS accounts. Use unique passwords and enable multi-factor authentication everywhere possible. Revoke unknown sessions, API keys, application passwords, and tokens, and contact the hosting provider if you find signs of intrusion. Because your email and payment accounts may also be exposed, secure those separately and notify your bank or card provider.
A compromised hosting, registrar, or FTP login can exist without an unfamiliar Search Console user remaining visible. The attacker may have added and removed access, or the alerts may have been triggered by a temporary change. Treat all three sites as potentially affected: make a backup for forensic purposes, run a full malware scan, review recently modified files, and look for unfamiliar scripts, administrator accounts, scheduled jobs, redirects, and files with suspicious timestamps. Pay particular attention to old themes, plugins, upload directories, and AMP-related code.
After a similar incident, a hidden PHP file in an old theme directory was creating spam pages. Checking the server through the host’s security tools or control panel can reveal files that a normal site-user review misses.
Check more than Search Console. Because all three domains received alerts at the same time, inspect the hosting account, registrar, DNS provider, FTP or SFTP accounts, databases, and any shared administrative accounts. Don’t reset DNS blindly until you document the current records and compare them with the expected configuration. The fact that DNS information appears differently for the domains could simply be due to how the provider displays managed zones, but it’s worth confirming with the registrar and hosting provider.
Only the merchandise domain currently shows DNS records in the account. I’m not sure whether the other two are managed elsewhere or whether something is missing, so I’ll verify the authoritative nameservers and DNS provider for each domain before changing anything.
The clean Search Console user list doesn’t rule out an intrusion. I’d preserve logs and a backup before deleting suspicious files, then rebuild or restore each site from a known-clean backup if the host confirms compromise.