sankari

These referers are independent of WordPress or the Juiz Social Post Sharer plug as they are also seen on sites without any of these.

It looks to me like referer spam by some criminals. Why?
1. The requests come from various countries, so they seem to use a bot net.
2. The domain holder does not disclose his identity.

I guess they want you to visit their web site, not for legal commercial reasons, but to hack into your computer if your system has security holes in outdated software.

I recommend to ban them from your websites if you can, by a WP plugin or on Apache servers in .htaccess:

# block referer spam
RewriteEngine On
RewriteCond %{HTTP_REFERER} buttons\-for\-website\.com
RewriteRule ^.* - [F,L]

Qti, one of my client’s blog was hacked in the same way. The blog uses an earlier version of WP.

The attacker’s IP is the same as above. Apparently the attacker used the wp-atom.php file to post a script into the header.php file of the active WP theme. That php file had write permissions by mistake.

According to the web server’s log this very IP address is not a first time visitor to the site and the only file it ever called was wp-atom.php.

I discovered the same WordPress user in the database.

By visiting the blog, the code attempted to download malicious code from a server in another country, probably a trojan. Some users reported unusual behaviours of their browsers such as a freeze or a browser question asking for permission to run an browser add-on. One user’s local network in his company even broke down.

I suggest to take the following measures which should enable you to run your WP blog again:

• Remove the malicious script from the theme file (PHP and Javascript code located in the head section)
• Delete the WordPress user.
• Correct file permissions for the theme files, where necessary.
• Ban above IP address from accessing your server.
• Delete the wp-atom.php file which is in the root directory. I am not sure if the file is still needed as some comments in the file say: * This file is no longer used in WordPress and while it is not deprecated now. – and – * This file will most likely be deprecated or removed in a later version.

Any other hints and measures from WP experts are appreciated. If you don’t have access to complete them ask your provider for help.

I agree with you that WP experts should look into the issue as to me it looks like a vulnerability of WP.