Spam hacked site - why it is not blocked?

polonus · June 1, 2016, 9:42am

Re: https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2Fexceleratedadvertisingsolutions.com%2F&ref_sel=GSP2&ua_sel=ff&fs=1
GoDaddy abuse.
1 suspicious file: index
Severity: Suspicious
Reason: Detected suspicious redirection to external web resources at HTTP level.
Details: Detected HTTP redirection to -http://zulotraffic.com/4.html?seoref=google.com%26parameter=exceleratedadvertisingsolutions.com%26se=$se%26ur=1%26HTTP_REFERER=http%3A%2F%2Fexceleratedadvertisingsolutions.com%2F%26product_id=.
File size[byte]: 0
File type: Unknown
Page/File MD5: 00000000000000000000000000000000
Scan duration[sec]: 0.001000

Re: https://sitecheck.sucuri.net/results/exceleratedadvertisingsolutions.com#sitecheck-details

Consider this bad request: https://asafaweb.com/Scan?Url=exceleratedadvertisingsolutions.com%2F%25s (template hack).
See: http://toolbar.netcraft.com/site_report?url=http://107.180.41.149

polonus

polonus · June 25, 2016, 11:35am

Update: And that campaign went on and on: http://killmalware.com/yukselcopy.com/ now cleansed but vulnerable and Google blacklisted.

Read also https://forums.digitalpoint.com/threads/wordpress-hack-hacker-redirect-se-traffic-to-his-site.874041/

WordPress insecurity: WordPress Version
4.3.4
Version does not appear to be latest 4.5.3 - update now.

Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.

ID User Login
1 None rkurtuldu
2 None
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. However it is important to understand that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.

polonus

Spam hacked site - why it is not blocked?

Announcements