This weekend, there are more and more attacks coming from various domains.
A short fix guide is available here: https://guides.magefix.com/2020/01/clean-url-adsformarket-com-redirects/
If you’re affected by this type of malware, it’s likely that all JS files are compromised.
Need help? Let us clean your site.
I’ve seen neglected sites, which have also JKH on. In this case, SEO recover might be needed.
Sample code:
Try our Free site check.
Main domains:
room.verybeatifulantony.com
verybeatifulantony.com
tom.verybeatifulantony.com
destroy.verybeatifulantony.com
wait.verybeatifulantony.com
destinyfernandi.com
middle.destinyfernandi.com
fast.destinyfernandi.com
slow.destinyfernandi.com
blog.destinyfernandi.com
Malicious URLs:
https://slow.destinyfernandi.com/dbekjrhg3?type=d&frm=scr&
https://tom.verybeatifulantony.com/a.js
https://tom.verybeatifulantony.com/y.js
https://slow.destinyfernandi.com/same.js
Other domains:
talktofranky.com
tmh-browser.club
meknews.biz
lodder1.biz
zwenews.biz
filmload.xyz
greenrelaxfollow.com
anwap-browser.club
terrout.biz
newswesti.site
trafficlmedia.com
redtext.biz
weenews.biz
nebulas.biz
portanews.biz
lurunews.biz
redrelaxfollow.com
loostnews.biz
deliverblackjohn.com
bluelabelmoscow.com
lifecontext.me
mirox22.biz
solo90.biz
roboverify.xyz
vinuser.biz
merunews.biz
loderik.info
newsen06.site
globallyreinvation.com
soooners.biz
realvids.pro
puttraffic.com
poolnews.biz
lodder.club
anwap-download.club
loderik.club
accongestion.com
watshvideos.club
newstext.biz
solo91.biz
filefilm.club
rootus.biz
newschanel.biz
newsfile.club
feernews.biz
makesomethird3.com
tutorlalspoint.com
292news.biz
koolernews.biz
sepuh42.site
daoa01.site
playgogo.host
neemwear.biz
nclubs.xyz
detainee.biz
filebit.pro
vip-titan-gel.online
roboverify.club
veertus.biz
lodder4.biz
anwapfile.club
wwserch43.biz
ajsh016.site
solo41.biz
tmh-download.club
newfile.club
newpuh05.site
roboverify.vip
afsh012.site
aesh011.site
alsh018.site
amsh019.site
limonz.online
limonz.tech
llllll.site
aash07.site
puhsend02.site
ansh020.site
anwapfile.site
adsh010.site
aksh017.site
autohs37.site
newspu03.site
qualuru.biz
rpa001.site
Hosting malicious scripts: lodders.club, noorotin.biz, news98.biz, go1news.biz, lodder.info, newtext.club, retoore.biz, vinuser6.biz, w1sercher.biz, wwserch41.biz.
