WordPress Malware Uses Google IP Checks to Cloak Content from Site Owners
Summary
A WordPress infection checks Google-related User-Agents and IP ranges before fetching remote content for crawlers, while showing regular visitors the legitimate site. The article describes its behavior, impact, indicators, and remediation steps.
Key points
- Malware injected into a WordPress site's index.php selectively serves content to verified Google infrastructure while regular visitors see the normal site.
- It checks User-Agent strings, then validates visitor IPs against hardcoded Google ASN ranges using bitwise operations, with IPv6 support.
- For verified bots, the script fetches content from amp-samaresmanor[.]pages[.]dev and displays it as if hosted on the compromised site.
- The malware logs outcomes, redirects spoofed bots to the home page, and falls back to /home/ if the remote content fails to load.
- The article says the infection can harm search reputation, including through blacklisting or deindexing; it reported five infected sites at the time of writing.
- Recommended steps include removing malicious files and suspicious accounts, resetting credentials, updating software, using a WAF, and monitoring core-file integrity and Google Search Console.
Article Details
- Attack Vectors
- Malware injected into a compromised WordPress site's main index.php file selectively serves remote content to Google crawlers after checking their User-Agent and verifying their IP address against hardcoded Google ASN ranges.
- The malware fetches the content from an external URL using cURL, prints it on the page, and redirects other visitors to the site's home page.
- The article reports that five websites were infected at the time of writing.
- Defensive Notes
- Delete malicious files or directories that are not recognized.
- Remove suspicious administrator accounts, including the reported help account, and reset administrator, FTP, hosting, and database credentials.
- Run a full antivirus and malware scan; keep software up to date.
- Use a Web Application Firewall to help block communication with known C2 servers and prevent malicious plugin uploads.
- Use File Integrity Monitoring to detect unauthorized changes to core files such as index.php, and regularly audit Google Search Console for unexpected indexed pages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amp-samaresmanor[.]pages[.]dev | Malicious remote content domain fetched by the malware and identified by the article as blocklisted by two VirusTotal security vendors. |
| URL | hxxps[:]//amp-samaresmanor[.]pages[.]dev | URL from which the malware fetches and serves malicious content to verified Google crawlers. |
MITRE ATT&CK
T1059.004 · Unix ShellThe injected PHP code in index.php performs conditional checks and uses cURL to fetch and serve remote content.T1105 · Ingress Tool TransferThe malware retrieves remote content from the malicious pages.dev URL using cURL.T1491.002 · External DefacementThe compromised site selectively serves injected content to search engine crawlers, changing the content they see.
Vendors
Products
Google Search ConsoleTo protect your site, we recommend implementing File Integrity Monitoring to detect unauthorized changes to core files like index.php and regularly auditing your Google Search Console for unexpected pages in the index.VirusTotalAt the time of writing, the malicious domain amp-samaresmanor[.]pages[.]dev is blocklisted by 2 security vendors on VirusTotal, and currently, 5 websites are infected with this.WordPressDuring a malware investigation, we identified a selective content injection attack inside the main index.php file of a WordPress website.