I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate.


The following rule in my .htaccess is causing Sucuri's free online scanner to report my site as infected with:

"Known javascript malware" - Location: http://my-subdomain.cu.cc/404testpage4525d2fdc/ ("my-subdomain" is not my real sub-domain).

Here's the rule:

RewriteRule ^([^\.]+[^/])$ http://%{HTTP_HOST}/$1/ [L]


Is there anything inherently wrong with my RewriteRule, am I somehow "doing it wrong"? Or, is this just much ado about nothing?


I'm using that RewriteRule to add a slash to any URL's that don't have a trailing slash - except URL's pointing to a file, e.g., index.php, myfile.html, etc.

It's very consistent and reproducible...if I comment out that rule and rescan, it's clean; re-enable, flagged again...ad nauseum. I can think of three possibilities (though I'm sure there are more):

  • a flaw in their scanning process;
  • something inherently wrong with that RewriteRule;
  • Sucuri is trying to drum up business from the unsuspecting; (Author edit)

In my .htaccess I also have:

RewriteCond %{HTTP_HOST} ^(www.)?mydomain.com$ [NC]
RewriteRule ^(.*)$ /mydomain/$1 [L]

That rewrites any requests to mydomain.com to a sub-directory of my public root (which I'll just call root, for brevity's sake). This is needed because I have a shared hosting account that allows unlimited domain addons, but they all must point to root. Those two lines are replicated 7 other times, all rewriting different domains to different sub-directories.

Finally, I have:

#block access to .inc files sitewide
<Files ~ "\.inc$">
  Order allow,deny
  Deny from all

That one should be self-explanatory. Prior to my scan, I had only one file in root - .htaccess. Everything else is in sub-directories - each sub-directory is dedicated to a different domain, hence my RewriteRules.

After reading some threads re: WordPress malware problems, I decided to run their scanner and check my site. So I created a dummy index.php in root, shown here in its entirety:

<meta charset="utf-8">
<title>Untitled Document</title>

I used one of my unused freebie CU.CC sub-domains to use with their scanner. That sub-domain is not in my .htaccess, so it automatically points to root.


This is the error page for http://my-subdomain.cu.cc/404testpage4525d2fdc/

Not Found

The requested URL /404testpage4525d2fdc was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at anchorage.cu.cc Port 80

4 Answers 4


Interesting, just read the background. I assure you has nothing to do with drumming up business. We have no need to do that. If you send us your info at [email protected] we'll see if we can't better understand what is going on.

The 404testpage is a test page we emulate to see output of a page when we can't pinpoint the issue but we can see the payload.

I am more interested on what is below the testpage. Do you have more information you can share? I wonder, the 404test page, below it, does it say 500 error or website disabled? Or something equivalent?

It might be that the scanner is being blocked.


  • Thank you, Tony. I'd already sent an email to [email protected], but I just forwarded a copy to @info. It's nearly identical to My Question, except with a screenshot of your infection warning. I've edited my Question with Apache's 404 error message. And please don't take my statement about "drumming up business" personally, I just included it as a possibility, since I know almost nothing re: Sucuri. No offense intended. :) Also, the test finishes instantaneously - I assume since my index.php has no links for your test to spider.
    – akTed
    Commented Jan 24, 2013 at 7:09

What do you get when you go to the "infected" URL? Is it an empty page or error page or something like that? Served with a "200 OK" response?

If so I would imagine that the scanner is expecting a "404 Not Found" error status code in the response, and complains about any other status. You could write that up as a false positive, or consider returning 404 for whatever the resource is. If you're not returning real content for the URL "/404testpage4525d2fdc/" then, yes, it should probably be 404.

I don't see any interaction with your RewriteRule. The scanner is complaining about the path that already has the "/" at the end, so that's not going to get rewritten.

Is there anything inherently wrong with my RewriteRule

For taking match groups from paths you might use the [B] flag, so that any special characters included as %xx sequences decoded in matching the rule come back out re-encoded instead of mangled.

And I'm not sure why you need the rewrite - the trailing slash redirect issue is usually handled automatically by mod_dir.

But I don't think it's anything to do with this problem.

  • Thanks, bobince. I edited my Question with the 404 error page output by Apache. Re: the RewriteRule, see my Question posted in Webmasters.SE for the reason it's necessary.
    – akTed
    Commented Jan 24, 2013 at 7:02

We are reporting that site because something is redirecting your traffic to the domain when its visited. Has nothing to do with the htaccess file rule you referenced. Something is hijacking your traffic.


Tony w/ Sucuri

  • I forgot to welcome you to SE...welcome. :) Just an FYI, you can edit your Answers (or anyone else's, for that matter), so instead of creating multiple Answers, you can amend your existing one as needed. BTW, thanks for your attention to this, very much appreciated!
    – akTed
    Commented Jan 24, 2013 at 7:16

This is definitely a cheap trick by Sucuri to create fake insecurity threat and drum-up business. This is exactly the case and error with same http://mydomain.com/404testpage4525d2fdc security warning for a page which does not exist on my website. Also, what makes things more suspicious is the fact that unlike EVERY other such service they do not have a "False Alarm" reporting form/webpage.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .