WordPress Malware - Redirect to (fast.destinyfernandi.com) - even after scan and clean [closed]
There are several ways how your web resource could be redirected to destinyfernandi.
- database could be patched and your own ligitimate code doesredirect
- some injected code in php or JS or html templates doesredirect either via window.location or meta or headers of response.
First discover what address you gets redirected to , whether it is destinyfernandi or some other URL.I mean you could be redirected to some "invisible" URL1 and server which servicing URL1 would redirect browser further to destinyfernandi.
Once you discover what is the first hop (URL) in redirects you can search for bad URL in source code and database dump.
There is also a chance that first hop URL ( most likely destinyfernandi) is obfuscated in your code but lets hope it is not the case.
You can also add break point which fires on redirects which could help you to identify obfuscated piece of JS code:
window.addEventListener("beforeunload", function() { debugger; }, false)