• You MUST read the Babiato Rules before making your first post otherwise you may get permanent warning points or a permanent Ban.

    Our resources on Babiato Forum are CLEAN and SAFE. So you can use them for development and testing purposes. If your are on Windows and have an antivirus that alerts you about a possible infection: Know it's a false positive because all scripts are double checked by our experts. We advise you to add Babiato to trusted sites/sources or disable your antivirus momentarily while downloading a resource. "Enjoy your presence on Babiato"

Help, website hacked!

anon7788

New member
Jul 16, 2020
25
1
3
Hey guys

I found a lot clicks come out from my site:
click.jpg clicks.jpg

I thought it was from the dooplay theme posted here months ago which was reported already, so I changed the theme, and the clicks still there.

I asked for help from hosting (Namecheap) service, they asked me to scan the hosting with the Virus Scanner of Cpanel, but nothing changed.

So i have to ask for help here.
Here are the plugins and themes I am using from Babiato:

theme: Alchemist (with a lot plugins)
Plugins: Yoast SEO Premium, FS poster (All disabled to test, all the unknown clicks still the same)

(All other plugins are from WP official)

ThOSE clicks go to:
districtbaloneywhiskers.com
oppositehometowndrunken.com
plywoodenchant.com
galacticmenueasier.com
faithfulfacultativeladder.com
tightsaturdayi.com
visitsfunk.com
tentmess.com
wilfulpessimistic.com
dividedscientific.com
rookmemorizevoluntary.com
locationsreverenceaid.com
tilltucked.com
splittingpick.com

Please help!!

Thanks
 
Dump database, this way you have a backup. Go trough it and search any references to those domains, check users. Change Cpanel pass and check for additional users. Enable 2fa. If you do have cpanel use the search in file manager to spot eventual files containing those domains.
Good luck!
 
  • Like
Reactions: diben and anon7788
Thanks for all the reply.
I tried wordfence and I found the malfare: monit.php under plugin folder. After I removed it and all other related files and data in MySQL, all the unusual clicks gone.
It's not the first time I found the malware in my sites, but never defeat it, hopefully this time wordfence works.
 
AdBlock Detected

We get it, advertisements are annoying!

However in order to keep our huge array of resources free of charge we need to generate income from ads so to use the site you will need to turn off your adblocker.

If you'd like to have an ad free experience you can become a Babiato Lover by donating as little as $5 per month. Click on the Donate menu tab for more info.

I've Disabled AdBlock