Am I hacked or not? Or is it all Google's fault?

I feel like Google has got me running round and round in circles at the moment on my laptop. Plus I think Google may well be the maverick in the mix!

Google is telling me - via Search Console - that a website I own has been hacked i.e. 

• a new sub-domain URLs exists - whereas I never ever use sub-domains
• i.e. sub domain name prefixes exist (e.g. https://hacker.mywebsite.com - where I own mywebsite.com )
• this is identified by gmail headed Alert - Hacked content found on (your website domain name URL)
• they then identify new website owners - of the new sub-domain
• this is identified in a gmail headed New owner for (sub-domain website URL)

Identifying non-existent sub-domains

I need to get them deleted but first I have to find them - and that is proving very difficult

To date, I have been wholly unable to identify any sub-domains - which should be obvious given how my page listing works.

It could be a tiny bit of script somewhere - but I haven't been able to find it as there are no clues as to where it is located.

Removing sub-domains

So I've been looking for help from Google by stopping all the sub-domains from being shared via the Google Search Index instead!

• via the Removals Tool in Search Console (in the Indexing Section in the left hand column)
• BUT this is only a temporary measure

Where you find the Removals tool

Google has acted on all my requests except one - for some reason. Need to work that one out.
However the removal from the index is only temporary - and I still need to work out why they exist.

Non-existent owners with gmails

I've reported the gmail addresses used by new sub-domain owners to Google Gmail 

• despite the fact that Google Search Console say they do not exist!!
• you can check who owns your website / domain name via Search Console Settings and Ownership Verification.

Unhelpful websites

So far, both my domain name registrar (Namecheap) and my website host (Square/Weebly) have proved to be pretty useless at helping me out. 

Neither have explained how the particular hack affecting me happens - and yet I can't be the first.

Apparently it's all down to me!

A helpful site if you get hacked

I have found one helpful website while working my round what on earth is going on.

Take a look at https://hacked.com/been-hacked/ for a page of tips and recommendations.

They also provide remote help for a fee. I've not tried it - as yet.
I'm still working on the principle that Google is doing something wrong!

One more thing..... Country blocking

I've got a stats package which provides very detailed answers and at the moment I have worked out that it looks likely that all the hackers and the sub-domains come from either China or Malaysia

So my next task is to work out how to block China and Malaysia!

I've done this before - but can't remember how and I think it might have been on different webware. 

I think I've just found an inexpensive app which might do this. It's worth a go....