Thread: Can you please check two sites for me

I got a message that two of my sites are redirecting visitors. I have tried myself, but nothing happend for me.
The sites are teensofbrazil and isshe18 , both .com

Do not click, just scroll down and keep the page open for about 30 seconds. Let me know what happend.

Thank you!

Yes i can confirm both sites redirected me using IE9. I tried both again a few minutes later with firefox with the noscript and adplus addons, they did not redirect, i turned off noscript on both and they did not redirect.

teensofbrazil redirected me to a search engine, then redirected me to the first search result of the search engine. isshe18 redirected me to a MFA site.

Originally Posted by Bluey

Yes i can confirm both sites redirected me using IE9. I tried both again a few minutes later with firefox with the noscript and adplus addons, they did not redirect, i turned off noscript on both and they did not redirect.

teensofbrazil redirected me to a search engine, then redirected me to the first search result of the search engine. isshe18 redirected me to a MFA site.

Damn..! OK, thank you Bluey for checking. I have asked my host to scan those sites. Hopefully they will find whatever this is. I have been searching myself, but can´t find anything. But.. any hacker IS smarter than me, so...

teensofbrazil went to financialnewsstories (dot) comin chromium.
isshe18 went to cdn.alphabird (dot) com/assets/iframes/cdn_windowphone2/frame_escapistmagazine_v8.htm in chromium.

With firefox and noscript I notice it's loading something from allabc (dot) com and itraffic (dot) cc on both sites. I don't know if you know about those or not.

Does anyone read any suspicious things here?

Code:

{HEX}php.include.remote.439 : 
./mysite.com/public_html/st/templates/index.html
{HEX}php.include.remote.439 : ./mysite.com/public_html/index.shtml
{HEX}php.exe.globals.384 : ./mysite.com/public_html/tp/data/logs/log.5-0
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/global-header.tpl
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/user-login.tpl
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/video-player-flash.tpl
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/video-player-quicktime.tpl
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/video-watch.tpl
{HEX}base64.inject.unclassed.6 : 
./mysite.com/public_html/templates/_compiled/video-player-silverlight.tpl

AMerinoc techs are scanning the server now. I can´t find shit and I get no redirects myself. I am on a shared server now - guess I will have to upgrade to dedicated and get the soft-com guys to scan and secure the box....

Sure it's not loading a redirect from an ad Horny Joe?
I don't get the redirect on my FF or Chrome... and the only thing both of my browsers have in common is AdBlockPlus and Flashblock. I don't use NoScript.

I also noticed Bluey and allniche do NOT get redirected while having NoScript either on or off...but I'm assuming both of them have an adblocker (you DO have an adblocker don't you Horny Joe and allniche?).

I'm using process of elimination here and an adblocker is stopping the redirection (so it's safe to assume it's an AD doing the redirect).

Turn off your adblocker(s) and see if you get redirected Horny Joe. I turned off mine and BAM! got redirected...turned AdBlock Plus back on and nothing.

It might be an ad, that is why I have decided to remove all iframe ads and just go with static banners.

Amerinoc support sent mail that they have cleaned infected files, can you please test again as I see nothing. I will also ask what files was infected and infected of what.

Just loaded isshe18.com, turned OFF AdBlockPlus and caught this redirect to Contentomania.
It shows that Ads By TrafficRevenue footer just before reloading the page and sending me to Contentomania.
isshe18_redirect_ad.png

Seems I need expert help if server techs cant find and clean. Then I will get a dedicated box and ask soft-com to scan and secure. It does not seem like amerinoc tecs can find it, since they said at first that it was clean - but ads still shows.... Damn.... But thanks a bunch for testing for me.

Okay, caught something loading in the upper left corner of your site, like a 1x1px square, and opened it using Inspect Element Info (right-clicked on it in firefox and chose Inspect Element Info from the context menu) and got this:
isshe18_element_info.png
If you look in the code, you'll see that allabc.com Bluey mentioned...and what is all that iFrame code just below it?

it does not redirect me for neither site atm.

Probably not helping, but not redirecting in Germany and Netherlands using IE8 and curl...

Originally Posted by A.C.

Remove the javascript loading /tp/filter.php and check again. From a quick look that's the problem.

The javascript loading /tp/filter.php isn´t the that called by TradePulse? How can I remove it?

Originally Posted by Dred

Okay, caught something loading in the upper left corner of your site, like a 1x1px square, and opened it using Inspect Element Info (right-clicked on it in firefox and chose Inspect Element Info from the context menu) and got this:
isshe18_element_info.png
If you look in the code, you'll see that allabc.com Bluey mentioned...and what is all that iFrame code just below it?

I try to find this now, but I can´t see it. The last iframe say something about juicy-js-link... I have removed all juicyads, except mobile redir. and a popunder. I fear that there might be something in the root, causing all this. Maybe from another user, even.

So, that takes me to Plan B - that should be Plan A. Dedicated box. I think about getting the "3-2120 DualCore" deal from Amerinoc or similar. You guys that knows about servers, does it look good for $175? I will of course try to ask for a better price https://www.amerinoc.com/dedicated.php

HJ, I moved one of my servers to xxhostit recently and was very impressed with the deal they gave me as well as the service.

OK, will not bother you guys (much) more now You have all been very helpful, but - can you please visit isshe18 com and teensofbrazil com once again now. Some files have been cleaned + I did a fresh install of TP on these domains, since there was some errors updating them. Please, please, please report back "No redirects"

Thank´s!

okay, AdBlockPlus off and....NO REDIRECTS on either site!
Good on ya dude!

They were recommended by other reliable webmasters too... I mean xxxhostit.com , Good AmateurFlix... damn i am still not familiar w the new board structure.. :S

checked both sites in IE and FF, no redirects