Website Malware Analysis and Cleanup Case

Symptom: Direct access to the website from a browser is completely normal, but when using site:domain in search engines, a large number of pornographic, gambling, gray-industry and other illegal pages appear. They are completely unrelated to the original website content, indicating spider hijacking and malicious code injection.

1. Case Background

Normal user access to the website is completely normal, with no pop-ups, no redirects, and no abnormal browsing experience. When using Baidu site:domain to check indexed pages, a large number of unfamiliar URLs appear, and their titles and descriptions are all spam content involving pornography, gambling, gray industries, etc.

Key point: When these abnormal links are opened directly in a browser, they still display the normal website content; only when search engine spiders crawl them is malicious content returned.

2. Reproducing the Phenomenon

Use curl to simulate a Baidu spider UA to access the website and reproduce the attack effect:

curl -A "Baiduspider" https://your-domain

• Normal browser UA access: returns the normal website source code.

• Simulated spider UA access: the content does not match the website and is all malicious spam.

3. Attack Principle

After hackers invade the website, they implant UA-recognition malicious code:

1. Determine the visitor's User-Agent identifier;

2. When ordinary visitors access, return the normal website page;

3. When search engine spiders such as Baidu and Bing are recognized, output pornographic and gambling spam content, misappropriating the website's authority for black-hat traffic diversion. Malicious code is often encrypted with base64, or normal code imports third-party code, making it difficult to find by visually inspecting the source code.

4. Investigation Process

1. Website source code inspection Focus on global common files, template headers, and configuration files. Search keywords: Baiduspider, spider, user-agent, base64_decode, etc. Check file modification times, locate files changed by non-operations actions, and unfamiliar PHP scripts newly added in directories. Most hackers implant backdoors, and the code is usually encrypted. If encrypted suspicious files are found, rename them first.

2. Log tracing Check website access logs and FTP login logs to locate the intrusion time and attack IP, and confirm the intrusion source (program vulnerability / weak password).

    

5. Cleanup and Handling Steps

1. Delete malicious backdoors and encrypted hijacking code, and restore the tampered website files;

2. Restore the original server configuration, and remove abnormal pseudo-static rules and content replacement;

3. Reset all passwords for the backend, FTP, and database; update website programs and plugins, fix website vulnerabilities, and apply patches;

4. Submit dead link removal and snapshot update in Baidu Webmaster Platform, resubmit the sitemap, and guide search engines to re-crawl;

5. For file security protection, tighten directory read/write permissions. Refer to: https://www.west.cn/faq/list.asp?unid=733 ;

6. Case Summary

This type of spider-targeted malicious injection is extremely stealthy, and ordinary users cannot perceive it. Its main harm is polluting search engine snapshots, causing website ranking demotion and K-site deindexing.

Investigation cannot rely only on whether browser pages appear normal. It is necessary to regularly perform site queries and simulate crawler UA fetch tests in order to detect such hijacking attacks in a timely manner.