Undetectable URL injected Wordpress Site, Can somebody help?

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #1

Good day dear great members of Babiato.
I have a WordPress magazine blog and somehow in the past it was infected. I did almost anything I'm capable of but no way to clean those links from the google search console. I scanned the entire site manytimes, I'm using Wordfence and it doesn't give any positive sign.
I tried to remove URL's by the key string and it worked somehow in the past. However, a few days ago the URL's poped up again.





as you can see --.com/site/page.php?c108c6= embedded somehow in the root but I can't not detect where it is. I would greatly appreciate if someone can give an advice.
Thanks in advance.

 

tuton012

Strive for progress, not perfection

Babiato Lover

Trusted Uploader

May 23, 2019

1,607

2,060

120

Near You

• Mar 31, 2021

• #2

did you install any plugin to the website before it started? how long has this been like this on your website?

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #3

tuton012 said:

did you install any plugin to the website before it started? how long has this been like this on your website?

Click to expand...

Thanks for your response. Well, months ago that happened and I found some malicious base64 codes after scanning the site and cleaned them. A long time later I noticed the links from G search console. I searched for the links in PHPMyAdmin but couldn't find any of them in the database. No scanner can detect them. Even though I report the links to google for deindexing, they keep existing. Search console notification says, 'Indexed, though blocked by robots.txt'. I don't know how to get around this problem.

 

NextMan

Member

Sep 8, 2020

59

20

8

• Mar 31, 2021

• #4

This page on live or 404? Any url?

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #5

NextMan said:

This page on live or 404? Any url?

Click to expand...

When I head over to the URL its 404. But it exists in Google search console index page

 

NextMan

Member

Sep 8, 2020

59

20

8

• Mar 31, 2021

• #6

Please use screamingfrog or etc. for 404 or live...


It may be a scheduled program. Urls are not always active. They can be active for a short time and then become 404 ... You need to check all your plugin and theme codes ...

 

S

slavstudio

Member

Oct 26, 2020

33

11

8

• Mar 31, 2021

• #7

This is well known issue with nulled plugins and themes, where some of sharers inject piece of code that ads links to your website and redirects them to specific links. I suggest you follow this https://www.wpaos.com/2020/11/13/how-to-fix-wordpress-hacked-url-injection/

Spam Links Injection in WordPress Site - Removal Guide [2023]

secure.wphackedhelp.com

Also, happened to me once. Code is added inside one of the theme/plugin .php file, most likely config files or footer/header.

I suggest you manually check your theme/plugins files, even better, disable one by one plugin and activate one by one, if you see that issue is not present anymore, you will know what plugin is the problem. Disable all plugins and if issue is still the same, your theme is most likely infected.

For cleaning links from Google Search console, you can send request to Google via Search console to deindex existing links.

 

phaze1G

Member

Aug 30, 2019

46

13

8

• Mar 31, 2021

• #8

shared hosting?

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #9

phaze1G said:

shared hosting?

Click to expand...

Yes its a shared hosting.

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #10

slavstudio said:

This is well known issue with nulled plugins and themes, where some of sharers inject piece of code that ads links to your website and redirects them to specific links. I suggest you follow this https://www.wpaos.com/2020/11/13/how-to-fix-wordpress-hacked-url-injection/

Spam Links Injection in WordPress Site - Removal Guide [2023]

secure.wphackedhelp.com

Also, happened to me once. Code is added inside one of the theme/plugin .php file, most likely config files or footer/header.

I suggest you manually check your theme/plugins files, even better, disable one by one plugin and activate one by one, if you see that issue is not present anymore, you will know what plugin is the problem. Disable all plugins and if issue is still the same, your theme is most likely infected.

For cleaning links from Google Search console, you can send request to Google via Search console to deindex existing links.

Click to expand...

I used to use nulled plugins before but I don't have any nulled one anymore. Also, wordfence scan can not detect any malicious code either.

 

S

slavstudio

Member

Oct 26, 2020

33

11

8

• Mar 31, 2021

• #11

flush27 said:

I used to use nulled plugins before but I don't have any nulled one anymore. Also, wordfence scan can not detect any malicious code either.

Click to expand...

It can't detect it because it is not malicious code, it is advert code.
Advert code can't be treated as malicious code because maybe user added it for ad ravenue. That is why wordfence doesn't show it.

 

S

slavstudio

Member

Oct 26, 2020

33

11

8

• Mar 31, 2021

• #12

It is most probably one link inserted into code that points to an ad server

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #13

slavstudio said:

It is most probably one link inserted into code that points to an ad server

Click to expand...

Is there a way of finding it or replacing with the original files?

 

S

slavstudio

Member

Oct 26, 2020

33

11

8

• Mar 31, 2021

• #14

flush27 said:

Is there a way of finding it or replacing with the original files?

Click to expand...

Do you use nulled template?

 

flush27

Member

Dec 10, 2019

23

39

18

• Mar 31, 2021

• #15

slavstudio said:

Do you use nulled template?

Click to expand...

I'm using Jnews at the moment, I downlaaded it from envato elements but after my subscription ended, I downloaded updated one from Babiato. So the theme is from Babiato, the rest of the plugins are from original repisatory.

 

HexGloss

New member

Mar 11, 2020

6

1

3

• Mar 31, 2021

• #16

have you tried a logger or firewall for outgoing connections??
i use "snitch" when using nulled plugins, works like a charm

GitHub - pluginkollektiv/snitch: Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic.

Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic. - pluginkollektiv/snitch

github.com

also, Core Control. https://github.com/dd32/core-control
Hope it works for you.

 

johnc

Well-known member

Feb 18, 2021

288

261

63

• Mar 31, 2021

• #17

Look into functions.php of theme and child theme (if any), most probably the malware codes are inserted here.
Look here anything strange or any strange URL.

 

T

TylerDurden

New member

Sep 19, 2019

13

8

3

• Mar 31, 2021

• #18

HexGloss said:

have you tried a logger or firewall for outgoing connections??
i use "snitch" when using nulled plugins, works like a charm

GitHub - pluginkollektiv/snitch: Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic.

Network monitor for WordPress. Connection overview for monitoring and controlling outgoing data traffic. - pluginkollektiv/snitch

github.com

also, Core Control. https://github.com/dd32/core-control
Hope it works for you.

Click to expand...

Thanks but are these still working with latest wordpress?

 

HexGloss

New member

Mar 11, 2020

6

1

3

• Apr 1, 2021

• #19

TylerDurden said:

Thanks but are these still working with latest wordpress?

Click to expand...

Yes they are, im currently using it.

 

• 

Reactions: TylerDurden

X

xeric

Member

Apr 5, 2019

93

21

8

• Apr 8, 2021

• #20

To search across all your theme and plugin files, I suggest downloading them all via FTP then use Notepad++ to Find text in folder which will scan every file in the folder for the text you enter.