Recently, We noticed so many infected websites redirecting to malicious URLs and spam domains. After a deep investigation it turned out to be caused by the vulnerable Rank Math SEO WordPress Plugin.
The vulnerable version is 184.108.40.206 so make sure you get it updated to last released version that have this vulnerability patched.
Here is a quick snippet showing the live infection in action as found on an infected website:
[root@toor ~]$ curl -I https://victim-website[.]com/
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Date: Mon, 28 Mar 2020 13:51:16 GMT
X-Redirect-By: Rank Math SEO
As you can notice, The Rank Math SEO is causing a redirect to the malicious domain ischeck which is then redirect to checkandgo and overzoruaon spam domains. Some of the malware domains involved with this specific hack incident:
Signup and Try our malware removal service and let’s clean & protect your websites!
Website Hacked OR #Blacklisted? Get it Cleaned & Protected Immediately!
Free Scanner: https://scan.attacker.net
#Security #wordpress #joomla #magento #drupal #hosting #cpanel #linux #websitesecurity #securedwebsite #hacked