2

I coded a simple landing page. Problem is, I added no additional lines of code but it keeps redirecting iPhone users to an IP/site I don't know... Tried browserstack's app to see if it was only that phone, but it's the same behaviour. So I'm afraid it being something malicious server-side.

My site is somosbravery.com

The problem occurs only in iPhone (already tested in PC and and Android phone).

Any clue...? Thanks!

Julian Abal
  • 49
  • 2
  • 8

1 Answers1

1

tl;dr - Your website was hacked

Just tested on an iPhone, somosbravery.com redirected to IP address 194.6.233.7, which is in a range assigned to a company in Ukraine, ukrmir.com.ua.

There is no response from that IP address.

Info from ipinfo.io.

Testing on desktop with small window (375 x 667), the redirected URL is:

http://194.6.233.7/mxjbb.cgi?default

There is a posting in support.google.com that discusses a website problem with the same redirected URL.

Entering https://somosbravery.com into the file viewr at aw-snap.info produces:

Header returned by request for: https://somosbravery.com/ -> 66.147.244.230

HTTP/2 302 server: nginx/1.16.1 date: Fri, 10 Apr 2020 23:15:20 GMT content-type: text/html; charset=iso-8859-1 content-length: 287 location: http://194.6.233.7/mxjbb.cgi?default Note: This line has redirected the request to http://194.6.233.7/mxjbb.cgi?default

So there must be a redirect on the server.

This page dated May 4, 2015 describes a .htaccess file hack that redirects to http://194.6.233.7/mxjbb.cgi?default, the exact same redirect target as in this case.

terrymorse
  • 6,771
  • 1
  • 21
  • 27
  • thanks for the information, but how could this be possible... the only thing I wouldn't 100% trust is the cdn import in my css. @import url('https://fonts.cdnfonts.com/css/helvetica-neue-9'); – Julian Abal Apr 10 '20 at 21:45
  • No idea, but I don't think is a DNS server problem. I accessed the same DNS router from the desktop, which worked fine. A http redirect in .htaccess? https://stackoverflow.com/questions/3680463/mobile-redirect-using-htaccess – terrymorse Apr 10 '20 at 22:10
  • It's not only iPhones, it also happens on desktop when the window is very small. Can you do a sitewide search for '194.6.233.7'? – terrymorse Apr 10 '20 at 22:15
  • Your .htaccess file is almost definitely hacked. Search for "mxjbb". – terrymorse Apr 11 '20 at 16:49
  • Thanks, completely forgot about that. Had no .htaccess in my site whatsoever anyway. I put in a default one and it's apparently dealt with now. – Julian Abal Apr 11 '20 at 17:16