Wtf Is this shit? Strange redirects on of my sites
 

Have i been hacked? Or just some wayward script/image? I saw it in pingdom, its a wordpress site, im using the theme on several sites, and none have these redirects. I dont any social plugins or use add this, and the links dont lead to add this anyways:

Remove the following redirect chain if possible:

http://addthis.mathtag.com/red/pixel?pid=11112
http://sync.mathtag.com/sync/img?mt_...1112%26ssrc%3?
http://sync.mathtag.com/sync/img?mt_...1112%26ssrc%3?
http://su.addthis.com/red/usync?pid=...3-27b656e74328
Remove the following redirect chain if possible:

http://cm.g.doubleclick.net/pixel?go...gle_gid&ssrc=1
http://cm.g.doubleclick.net/pixel?go...c=1&google_tc=
http://su.addthis.com/red/usync?pid=...&google_cver=1
Remove the following redirect chain if possible:

http://dpm.demdex.net/ibs:dpid=420&d...nc%3Fpid%3D16?
http://dpm.demdex.net/demconf.jpg?et...ddthis.com%2F?
http://su.addthis.com/red/usync?pid=... 656811&ssrc=3
Remove the following redirect chain if possible:

http://ib.adnxs.com/getuid?http%3A%2...UID%26ssrc%3D1
http://ib.adnxs.com/bounce?%2Fgetuid...%2526puid%253?
http://su.addthis.com/red/usync?pid=...0963602&ssrc=1
Remove the following redirect chain if possible:

http://segment-pixel.invitemedia.com...&sscs_active=1
http://cm.g.doubleclick.net/pixel?go...OBUB4tNORjCQ==
http://g-pixel.invitemedia.com/gmatc...o ogle_cver=1
Remove the following redirect chain if possible:

http://adadvisor.net/adscores/g.pixel?sid=9201991568
http://su.addthis.com/red/usync?pid=11121&puid=&ssrc=3
Remove the following redirect chain if possible:

http://ds.reson8.com/vendor.gif?v=CS&c=51945a355739fb23
http://ds.reson8.com/pop.gif?RCOUNT=1
Remove the following redirect chain if possible:

http://i.w55c.net/ping_match.gif?st=...uid%3D_wfivef?
http://su.addthis.com/red/usync?pid=...5793d2f&ssrc=1
Remove the following redirect chain if possible:

http://tacoda.at.atwola.com/atx/sync...default?ssrc=3
http://su.addthis.com/red/usync?pid=...158svpj&ssrc=3
Remove the following redirect chain if possible:

http://tags.bluekai.com/site/13961?i...Fusync%3Fpid%?
http://su.addthis.com/red/usync?pid=...H%2Cdal&ssrc=1

Do you have backups? Looks like you have an injection. I didn't click any of your links btw, just my experience to wipe it out and replace with a backup.

There are site testing tools to see if its infected. sitecheck.sucuri.net is one such site. Also try running maldet on the system or some anti-virus tool, It suck losing data but as the last recourse would be a full system restore.

See if your host knows how to remove it without losing your stuff (Backup first ;) )

That's not very productive... They'll just inject the stuff again... Best to remove the injections and pinpoint where they are doing it and have it patched... Reverting to a backup is only a temporary solution and not even a good one.

The links dont lead anywhere i tried them, I cant find a reference to this stuff in any of the source code

thanx for posting it here :1orglaugh

Full system restore not an option. I checked it on googles virus total:

https://www.virustotal.com/en/file/0...ec33/analysis/

Doesnt seem to carry a virus but is used to capture traffic? So its redirecting some traffic? :helpme

your links gave me herpes

Restore site, get rid of virus and/or malware, pinpoint the hole. I highly doubt his site is being attacked by a watchful eye and needs immediate attention regarding security breach.

Which is very likely to be a wordpress hole. But it would suck without the backup. Host may be able to help. They should be able to run a scan of the entire server.

they ran a malware scan and didnt find anything :(

Do you have it on G Webmaster Tools? If so, does that detect anything?

say hi to your Ukraine friends!

and yes, that's an injection known as CAP of type network or traffic capture. Teel your host to look for something like the info below

Host still cant find this would it be in certain areas?

:thumbsup:thumbsup:thumbsup

1 check your httaccess
2 if wordpress, check the theme php files

look for: nVRNj9owEL33Z1gqShqj+iMOdr3e....
#c3284d#

and all other stuff the it crowd guy posted

Christ you guys know too much.

is it safe to use addthis widget ?

Im not using or want to use the widget. I have this theme on several other sites, on several other host, none of the same redirects

so, did you fix it?

:mad: no have headache now need beer try later

I've read about some apache hacks lately where instead of merely messing with the configuration or site files they have been replacing the actual binary. See http://www.webhostingtalk.com/showthread.php?t=1260736