Hack redirection to Japanese site

  • RuLLezZ

    (@rullezz)


    6 years, 2 months ago

    Hello community, our websites are hacked and when you google one of them and press to the link it goes to Japanese website. We found all the scripts but we can’t found the hole.
    Our websites are totally updated with latest wordpress/plugins/themes.

    Any one got the same problem last days? thnx

    • This topic was modified 6 years, 2 months ago by RuLLezZ.
    • This topic was modified 6 years, 2 months ago by RuLLezZ.
Viewing 8 replies - 1 through 8 (of 8 total)
  • Aims Infosoft

    (@aimsinfosofts)

    6 years, 2 months ago

    Hello,

    First try to deep breath and read following document, it will help you how to recover hacked site.
    https://wordpress.org/support/article/faq-my-site-was-hacked/

    Thanks

    Thread Starter RuLLezZ

    (@rullezz)

    6 years, 2 months ago

    Bro we recover every site, the problem is the hole. Because after we clean everything in some hours it happens again.
    All themes/plugins/wordpress are updated and we can’t found anything in google about attack for this period of time. 20 July till today.
    It is possible to be hacked from hosting/ftp/etc?

    • This reply was modified 6 years, 2 months ago by RuLLezZ.
    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    6 years, 2 months ago

    >> t is possible to be hacked from hosting/ftp/etc? <<

    Yes. Change the password for your hosting account, ftp, etc.

    Install WordFence and use it to do an aggressive scan of your site.

    Thread Starter RuLLezZ

    (@rullezz)

    6 years, 2 months ago

    We using our custom platform something like cpanel where we can see all our websites and work on it, platform hosted at OVH.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    6 years, 2 months ago

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter RuLLezZ

    (@rullezz)

    6 years, 2 months ago

    Maybe this will help you to understand where is a hole and how can be fixed.

    1. Scripts: xnikx68min.php / Thumbs.php / coment. In wp-content folder. (inside of xnikx68min was written “Indonesian hackrs” )
    2. This link give full access to the website: /wp-admin/1337.php
    3. They chenge/put files in Akismet plugin
    4. Beleve me an more and more.. things in theme and plugin folders and etc, anyway.
    5. Redirection to the one Japanese site jcdizefc . online (this happens when you use google search with an keyword or just with brand name, also at right side at Google My Business.
    6. Most of website are full updates exept 1-2
    7. We using 7.0.5 php version on all websites
    8. Protection provided by custom platform for managemant websites
    9. We don’t use plugins like Worfance 24/7, but only for scan.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    6 years, 2 months ago

    >> Because after we clean everything <<

    How do you “clean everything”?

    Thread Starter RuLLezZ

    (@rullezz)

    6 years, 2 months ago

    We tried to delete all the scripts/folders/files from the website, we scan it with Wordfance, clean also wordpress files that was modified with scripts. Then scan it again to be sure.
    The website started working again normally, but after some time 3-4 hours they were hacked again with different scripts were installed on each site and in different places.

    Then we tried to use the backup, but it didn’t help.

    • This reply was modified 6 years, 2 months ago by RuLLezZ.
Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Hack redirection to Japanese site’ is closed to new replies.