4

I am trying to investigate a weird attack on a Joomla 3.6.5 website: If you access the website directly through its URL, everything works as expected. However, if you search for the website using Google and use the search result (showing the exact same URL that works fine) you end up being redirected to another (scam) website.

How could someone facilitate this? Would taking control of the Google Webmaster tools be sufficient to setup such redirects?

Improve this question
1
  • 1
    User agent hack either in your .htaccess or template files of Joomla.
    – Simon Hayter
    Commented Jun 13, 2017 at 20:19

2 Answers 2

Reset to default
4

How could someone facilitate this?

Compromising any part of the PHP/Joomla/Plugin code could be enough to implement such a redirect.

However, these attacks are commonly achieved by writing malicious code to the .htaccess file that then checks the HTTP Referer and redirects the user visiting from the Google SERPs.

Would taking control of the Google Webmaster tools be sufficient to setup such redirects?

No - you can't implement such a redirect within Google Search Console (formerly Webmaster Tools)

Improve this answer
2
  • 1
    Google maintains a comprehensive guide to help you clean up your hacked site: developers.google.com/webmasters/hacked
    – Stephen Ostermiller ♦
    Commented Jun 13, 2017 at 17:06
  • There seems to be a large scale attack affecting the hosting provider of the website. The last version of the .htaccess file I have access to seems fine, however.
    – thruun
    Commented Jun 14, 2017 at 20:50
3

There are a lot of places where a little tiny code can be implemented that does the job!

Here are my suggested steps to take towards fixing the issue:

  • You may find out where is that code exactly written by opening your joomla folder(ftp, sftp) and checking your last modify date of the folders > files. This way you may find where is the bad code!

  • I would also recommend you to update your Joomla to latest version
    asap!

  • If you are already on the latest version, I recommend you to
    reinstall the Joomla core by going to Administrator > Components > Joomla Update and click on the reinstall core button!

  • If after this the issue is still present, then the issue is
    somewhere in the templates folder or somewhere in the 3rd party
    modules/plugins that are not coming with Joomla by default. If
    there are such extensions(modules/plugins) try disabling them from Joomla admin and check if the issue is still there!

  • Also please check your .htaccess and see if there is any strange code present! if possible, remove .htaccess and after reinstalling the Joomla core, rename the htaccess.txt to .htaccess.

P.S. If it is always redirecting to the same scam site, try searching the whole project(files/folders) by the domain name of the scam website!

Hope this helps! Best, Gev

Improve this answer
1
  • Thanks for your extensive suggestions. Currently I am unable to check all your recommendations, because my hosting provider is under attack :/
    – thruun
    Commented Jun 14, 2017 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.