---
title: "WordPress Redirect Hack via Test0.com/Default7.com"
url: https://securityorb.com/wordpress-redirect-hack-via-test0-comdefault7-com/
type: post
date: 2016-05-06
modified: 2016-05-06
markdown_url: https://securityorb.com/wordpress-redirect-hack-via-test0-comdefault7-com.md
author: "Kellep Charles"
---

# WordPress Redirect Hack via Test0.com/Default7.com

### WordPress Redirect Hack via Test0.com/Default7.com

An article written by [Denis Sinegubko](https://blog.sucuri.net/author/denis/):

![05052016_WordPressRedirect_V1](https://blog.sucuri.net/wp-content/uploads/2016/05/05052016_WordPressRedirect_V1.png)
We’ve been working on a few WordPress sites with the same infection that randomly redirects visitors to malicious sites via the **default7 .com** / **test0 .com** / **test246 .com** domains. In this post, we’ll provide you with a review of this attack, investigated by our malware analyst, [John Castro](https://twitter.com/mirphak).

### Header.php Injection

In all cases, the malware injects 10-12 lines of code at the top of the **header.php** file of the current WordPress theme:

[![Malicious injection in header.php](https://blog.sucuri.net/wp-content/uploads/2016/05/malicious-injection-in-header-php-650x556.png)](https://blog.sucuri.net/wp-content/uploads/2016/05/malicious-injection-in-header-php.png)
Malicious injection in header.php

When decoded, you see this main part of the malware:

[![Decoded malware](https://blog.sucuri.net/wp-content/uploads/2016/05/decoded-malware-561x650.png)](https://blog.sucuri.net/wp-content/uploads/2016/05/decoded-malware.png)
Decoded malware

The logic is simple. It redirects visitors to **default7. com** if it’s their first visit to this site after the infection, then it sets the **896diC9OFnqeAcKGN7fW** cookie for one year to track returning visitors. If they are not search engine crawlers, it checks the user agent header.

For more information, read more [here](https://blog.sucuri.net/2016/05/wordpress-redirect-hack-test0-default7.html?utm_source=Sucuri+WordPress+Plugin&utm_campaign=11066cc799-WordPress_Redirect_Hack_05_05_16&utm_medium=email&utm_term=0_4ac850e5be-11066cc799-82485121).