I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's the kicker - it ONLY happens for users on AT&T LTE networks. All other network connections are completely unaffected and receive a completely non-hacked site. I have triple checked this. Even Sucuri is seemingly fooled by this (returning completely clean).
- It happens on every known device, Android, iPhone, iPad, even laptops, so long as they are tethered to an AT&T LTE connection.
- If I take the SAME device and connect to WiFi and reload the hacked page, the original, non-hacked content returns.
- If I then get off Wifi (and onto AT&T LTE) and reload, and the entire page changes and I receive the hacked page again. All the while the URL stays the same. Verizon is unaffected.
I have access to the site registrar and host and everything seems a-ok in both places. DNS hasn't been changed. Additionally, the index page is fine, so I don't think it's a DNS issue. As I said, I've run sucuri checks (completely clean).
It's hard for me to understand what motivation a hacker would have to only target users on AT&T LTE, let alone how that would be pulled off. I realize that's broad and out of scope, but hopefully this question isn't: Assuming anything is possible, is this a probable hack? How can I determine if this is actually a hack, or something like a sneaky DNS Hijacking or caching issue? If it is hacked, what steps can I take to sniff this out and clean it up?
I'm happy to send the URL to anyone if you want to see for yourself, but not posting here for obvious reasons. I appreciate your help!
UPDATE: I marked an answer below since the answer covered both possibilities well, but for those wondering, this WAS a hack. I cleaned up the entire site systematically (everything but the DB) and the problem went away. Very interesting that the hack fooled Sucuri and all other scanners and only targeted AT&T mobile users.