2

Last week, a co-worker/client of mine emailed me to tell me that she noticed the primary phone number on our website had changed. Nobody on the team has touched that phone number, and neither had I, so I went into the backend of WordPress to change it back to the correct number, and every time I attempted to do so, it would automatically change to this incorrect phone number. When you reload, the page, it'll show the correct number for a split second, and then change to the new/wrong number. I've troubleshot and researched around and kept seeing people mentioning that Google Tag Manager can sometimes cause this, so I removed the GTM code and that still didn't fix the issue. We had SitLock run a malware scan and they didn't find any malware, since I believe it is simply a line of a script somewhere that is auto-changing. The phone number changes regardless of how I format or space it. We're concerned that somebody hacked into the website and added this line of code to divert through a number that is recording calls to steal sensitive information such as credit card numbers given over the phone to pay for classes and workshops. Different people on the team have reported seeing two different phone numbers (I suspect the script has something that changes depending on IP addresses). When you call the phone number, it plays a "This call may be monitored or recorded" message before going into the company's actual menu options. Nobody on the team has ever set up a call-recording service, nor would anyone need to as it's a small company and small team. When you do a Google search for one of the two phone numbers, it shows up as a highly suspicious scam number, which is adding to our concern. Please help! I have no idea where to locate this script.

Plugins in use:

  • Akismet Anti-Spam 5.1
  • Bloom 1.3.12
  • Child Theme Configurator 2.6.0
  • Divi Events Calendar 2.6.3
  • Go Live Update Urls 6.5.1
  • Jetpack 11.9.1
  • MalCare 4.87
  • OptinMonster 2.13.0
  • The Bluehost Plugin 2.12.21
  • The Events Calendar 6.0.11
  • The Events Calendar Extension: Relabeler 1.1.0
  • The Events Calendar Extension: Remove Past Events 1.0.0
  • The Events Calendar Extension: Tweaks 1.1.0
  • TrustPulse API 1.0.8
  • WordPress Importer 0.8
  • Wow Carousel for Divi ( Free ) 1.2.10
  • WP File Manager 7.1.8
  • WP Mail SMTP 3.7.0
  • WPCode Lite 2.0.8.1
  • WPForms Lite 1.8.0.2

Inactive Plugins:

  • All in One SEO 4.3.3
  • Classic Editor 1.6.2
  • Creative Mail by Newfold Digital 1.6.7
  • Google Analytics for WordPress by MonsterInsights 8.13.1
  • The Events Calendar Extension: Calendar Customizer 1.0.0
  • The Events Calendar Extension: Divi Compatibility 1.2.1
  • The Events Calendar Extension: Instructor Linked Post Type 1.0.2
  • WooCommerce 7.5.0
  • WooCommerce Payments 5.6.1
  • WP ULike 4.6.6
6
  • 2
    More information is required to assist you. Have you looked in the Browser to see what resources are being loaded. You can see al the css and javascript there. Commented Mar 21, 2023 at 23:15
  • I'm not sure I completely understand what you're saying. Do you just mean using the inspect feature on the browser? I have used that and haven't been able to find anything. The website we're having the issue on is artcentergreenville.org Commented Mar 21, 2023 at 23:20
  • I empathise, but I don't think that this is the correct place to post this query. MAYBE wordpress.stackexchange.com. Assuming the number in question ends "3948" this is being rendered as part of the HTML, meaning that if something has been hacked it is either Wordpress or a plugin (ie its not being done through a call to an external site). Thought - is it possible that there is a cache which needs to be flushed?
    – davidgo
    Commented Mar 22, 2023 at 1:55
  • 1
    2 things i would do - 1. Verify the Wordpress install. I can't tell you how to do this in general, but if you have shell access and the wpcli script you can run "wp core verify-checksums" to verify the Wordpress install has not been hacked. Then disable all the plugins, make the change and see if the change sticks. Then re-enable the plugins until you have found the problem one.
    – davidgo
    Commented Mar 22, 2023 at 1:58
  • 1
    You might also want to update your post with a list of plugins and versions - we may be able to identify a known vulnerable plugin?
    – davidgo
    Commented Mar 22, 2023 at 1:58

1 Answer 1

7

It looks like the following script linked in the <head> is what is changing the phone number:

<script type="text/javascript" src="//cdn.rlets.com/capture_configs/92d/d4e/4ab/5b64147a54994b44425cb4b.js" async="async"></script>

If this line of code doesn't appear in your original HTML source code, then something on the server is inserting it, and further server-side investigation would be needed to find out what is inserting this script into the page.

After looking over the contents of that script, it seems like it might be from a company called ReachLocal. The script might be changing the real phone numbers into special tracking phone numbers and changing links to e-mail addresses to instead work as contact forms. These changes might be intented to track how visitors found the website and if they are using the phone numbers or clicking the e-mail links.

I don't know if this script is the result of malicious activity or an intended addition to the page. Either way, those kinds of tracking methods seem very concerning.

Here is the troubleshooting method I used:

  1. Using the "local overrides" feature in Chrome, I saved a local copy of the page, then edited the HTML of the page so that it contained only links to scripts, inline scripts, and a single instance of the phone number in the body.

  2. In the Elements page of the Dev Tools window, I set a breakpoint on the body to catch any modifications: Right-click on <body>, go to the sub-menu "Break on", and check the option for "subtree modifications".

  3. Each time the breakpoint was hit, I used the "pretty print" button (the {} icon) to make the code more readable. After refreshing a few times, one of the times the breakpoint was hit landed on code in the 5b64147a54994b44425cb4b.js script that was replacing the phone number.

  4. I further edited the HTML so that it only contained the link to this script and one instance of the phone number in the body. After refreshing the page, the phone number still changed, so that further suggested this script was the cause. Alternatively, when I restored the HTML to the original, then removed the link to this script, the phone number no longer changed.

1
  • Wow, a million times thank you!!! I can't believe that was the solution. ReachLocal is an analytics marketing company we used, and they never explained to us that the script would do all of that, they just said it was going to track more general analytics. That script was added to the site a while ago, so I'm surprised it just now started doing things to the phone number. This was all out of my wheelhouse since I'm not much of a developer beyond super basic stuff, I'm mainly a designer. I removed the script and the phone number went back to normal just like you said. Again, thank you so much! Commented Mar 22, 2023 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.