2

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including Google and Yahoo, but notable NOT anonymous search like duckduckgo).

In IE with high security settings the user gets a prompt that content is being blocked. Firefox and Chrome display warnings as well.

The error appears like this in dev tools: "Mixed Content: The page at [removed] was loaded over HTTPS, but requested an insecure script 'http://ariadnnakiss.pw/m/zLZlP-SXnQrHhT_q_ywsOKj-.js?QB2M=6w5Q7T2e2a&P-0mA5Ga=cd99J0t91&_=12-1d-13-6&DyfkA=as426S9Uy3e&h=t7'. This request has been blocked; the content must be served over HTTPS."

The URL in question is ariadnnakiss, which I cannot find much information on beyond a whois lookup.

Any ideas why this would occur only when reaching the site via search?

  • You may have been hacked. Make sure your CMS or blogging software is up to date as well as all plug-ins, extensions, and themes. Update any other web based software, the OS, and all system services too. Run an anti-virus on your hard drive including rootkit. From there check your sites files, database, and directories for files and entries that are not right. This requires a lot of highly detailed work. Research this thoroughly. – closetnoc May 21 '15 at 16:08
3

Your web server contains a configuration file with a configuration that directs traffic from certain sources to pages with the suspicious script.

If you're using apache, start with the .htaccess files in your document root folder and every folder recursively within it.

Look for any lines containing "user_agent" or "remote_addr" or even google or other search engine names. Also, check for a list of specific IP addresses. Trying to comment them out then rerunning your site might be all you need to do.

If that doesn't work, you can also look at apache's default configuration file (httpd.conf) for references to the words I mentioned above.

Here's an example of how to reproduce your situation on any web server with apache installed:

  1. Create a normal index.htm or equivalent page with content for all to see and save it to the document root folder.

  2. Create the same page but add the suspicious script and save it as codewithsuspiciousscript.htm and upload it to the same location as index.htm

  3. Create a file named .htaccess with the following contents:

    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} ^googlebot$
    RewriteRule ^(.*)$ /codewithsuspiciousscript.htm
    

Then upload it to your document root folder.

Now when google visits any page, they will see the suspicious code because codewithsuspiciousscript.htm is loaded as a result from the user agent matching with google. When everyone else visits the page, they will see the normal page.

| improve this answer | |
  • What if its on a Window server? Should this still work? – tyler lauw May 21 '15 at 19:12
  • Windows is an operating system. Popular webpage servers for windows include Microsoft IIS, Apache, and I think nginx. – Mike -- No longer here May 21 '15 at 19:33
  • Sorry, that's what I meant its Microsoft IIS. – tyler lauw May 21 '15 at 19:56
  • Sorry, I don't use microsoft IIS, but I'm sure theres a configuration file with it or maybe settings in the windows registry that might give you clues on the source of the problem. – Mike -- No longer here May 21 '15 at 21:04
  • +1. I had a similar issue recently where popups intermittently occurred depending on the referring website and malicious .htaccess files were the culprit. I assume the same exploit is possible via malicious web.config files on an IIS server. – Neil Robertson May 22 '15 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.