My Drupal site is having some redirect malware issues. I suspected some strange redirects and tried to catch redirects by caching them through Nginx. Below is the output of one redirect.

Page https://www.test.com/officialsite doesn't exist on the site. No URL redirect with this value.

However, visiting https://www.test.com/officialsite produces a redirect loop because it leads back to Nginx instead of hitting Drupal which would have possibly redirected it elsewhere as a result of malware.

What I have done:

  • Checked all files (no changes - we manage the codebase via a Git repository)
  • Checked Variables and System Tables and can't find anything unless I am not looking for correct
  • Running Drupal 7 up to date

And running out of ideas!

Sorry can't enclose it in code as it loses formatting.

^E^@^@^@^@^@^@^@¯Ô d^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ÿÿÿÿÿÿÿÿ/à<9c>d^@^@^@^@<8b>Ù¾B^@^@g^AJ^B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ KEY: /officialsiteGET ^A^F^@^A^@Û^E^@Status: 301 Moved Permanently^M X-Drupal-Cache: HIT^M Link: https://www.test.com/officialsite; rel="canonical"^M Location: https://www.test.com/officialsite^M Content-type: text/html; charset=UTF-8^M ^M

  • My guess is your site has been hacked and the malicous code is trying to redirect your users elsewhere. If your code is in a git repository doing a "git diff" on the live server will likely show lots of altered code Jun 29, 2023 at 13:38
  • Looks pretty hacked to myself as well.
    – Jaypan
    Jun 29, 2023 at 14:06
  • Are you sure? Is it not gzipped?
    – JM John
    Jun 29, 2023 at 23:14


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.