Where to find these intruders?

  • Serge

    (@wordpressorg21)


    11 years, 6 months ago

    One of the websites was compromised, here is Show Source gives on the Front page.

    ————

    Website was hacked and inserted the following:

    <div style='text-indent:-9999em'><a href="http://www.homedepotcoupons.org" rel="follow">Home Depot Coupon Codes 2012</a> <a href="http://www.lexapro-side-effects.org" rel="follow">Lexapro Side Effects</a> <a href="http://www.couponstocks.com/office-depot-coupons/" rel="follow">Office Depot Coupons</a> <a href="http://www.jcpenney-coupons.org" rel="follow">JCPenney Coupons</a> <a href="http://www.pizza-hutcoupons.com" rel="follow">Pizza Hut Coupons</a> <a href="http://www.bigbrotheralbania6.org" rel="follow">Big Brother Albania 6</a> <a href="http://muzikshqip.shtypidites.com" rel="follow">muzik shqip</a> <a href="http://www.citalopramside-effects.org" rel="follow">Citalopram Side Effects</a> <a href="http://www.joann-fabrics-coupons.org" rel="follow">Joann Fabrics Coupons</a> <a href="http://www.neurontin-side-effects.com" rel="follow">Neurontin Side Effects</a> <a href="http://horoskopi.shtypidites.com" rel="follow">Horoskopi</a> <a href="http://www.couponstocks.com/walmart-coupons/" rel="follow">Walmart Coupons</a> <a href="http://www.iatenololsideeffects.com" rel="follow">Atenolol Side Effects</a> <a href="http://hostgatorcoupon.clickwebhosting.com" rel="follow">hostgator coupons</a> <a href="http://www.couponstocks.com/kohls-coupons/" rel="follow">kohls coupons</a> <a href="http://www.couponstocks.com/bed-bath-and-beyond-coupon" rel="follow">bed bath and beyond coupon</a> </div><!-- start header -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head profile="http://gmpg.org/xfn/11">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

    On the bottom:

    </body>
</html>
<script type='text/javascript' src='[ redacted ]'></script><!-- Don't delete this -->

    —————-

    Where to look for these lines?

    Thank you!

  • The topic ‘Where to find these intruders?’ is closed to new replies.