WordPress.org

Forums

how to remove Redirect to http://146.185.220.110/i.html (2 posts)

  1. themarx
    Member
    Posted 1 year ago #

    Hi,
    2 days ago, my client site went down. I have no idea why.
    When I was logged in, site looks good. But when I want to use it as anonymous, on every page I got redirected to http://146.185.220.110/i.html/{bla bla bla}
    All of scanners (plugins) show nothing.
    But I found that the problem was folder located in /wp-content/plugins/wpppm/

    In that folder I found something wired. I compare these files to original WordPress pack, there isn't something like that. I deleted it. Everything is good now.

    But the interesting fact is that what is in that folder :)
    When I was looking for adress like 146.185.220.110 I found nothing, because this link is genereted by other server http://146.185.220.75/v.html?v=$ver&h=
    Whats more, it it added to 404 page and all plugins, look:

    if(function_exists("add_action"))
    {
            add_action("404_template", "fourofour");
    }
    else
    {
            fourofour();
    }
    
    if(function_exists("add_filter"))
            add_filter("all_plugins", "fourofour_pp");
    
    return 1;

    I hope it will help someone.

    Full code:
    https://copy.com/3zT006PZeESC

  2. Was the site hacked? If it was then editing that code that way won't prevent the hack from coming back.

Topic Closed

This topic has been closed to new replies.

About this Topic