0

Using Chrome, I went to a website of a company we were researching, following a link from a google search, and got redirected to a malicious website. After killing Chrome and scanning for viruses, I decided to investigate. In a VM, I did the same google search and took the same link, but this time there was no redirect. I think tried not in a VM and same thing, no redirect.

The site is Wordpress-based which makes me thing that they may have been compromised, as I've heard this is common for wordpress sites.

At this point though, it could have been another page or ad on another page opening a malicious window. I checked my history but I have no way to tell how the window got opened. Clicking on their site could have been just coincidence. I've been trying to see if there is a way to detect what opened the link, but have not found one yet. What I'd like to know is if I can confirm that this is happening on their website so I can report it to them. For instance, if it's possible for me to detect something like this, assuming it's not happening regularly or to me anymore.

Edit: I forgot to mention that the website has very little "live" data on the page, as it's mostly informative. There are no ad banners or anything like that, though they do have a twitter feed at the bottom. This seemed to rule out a malicious advertising network.

Improve this question

1 Answer 1

Reset to default
1

It is not uncommon for infected sites to only infect some visitors, detect repeated visits, exclude specific IP ranges or user agents from infection etc. This is done to not be detected by researchers and thus stay off blacklists and this way infect more users. See for example WordPress Redirect Hack via Test0.com/Default7.com where they describe that redirects within this specific infection happen only in 15% of all cases.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .