Website hack: the billionth Google search - giveaway redirect

A popular target of current spam campaigns is a supposed Google giveaway. Accompanied by a shower of confetti, the message "You have made the billionth Google search" appears. Of course, there is nothing to win here and it is a fake. The site serves solely to collect personal data, which is then sold.
The cause of the giveaway redirect is often a hacked (WordPress) website. Triggered by script viruses, after a just under 5-second redirect loop you end up on the data collectors' pages.

Update from February 2021:

Unwanted WordPress advertising - "Amazon loyalty program / customer survey"

For a few weeks now, another variant of the unwanted WordPress advertising has been active - users are being redirected to a fake Amazon competition. The supposed Amazon loyalty program is fake.
Do not take part in any customer survey or any competition. This is a subscription trap.
If you have already done so, please request immediate cancellation and deletion of your personal data from the respective provider. Do not worry about any payment obligations that are supposedly arising from this. That is not the case with this scam.

Remove WordPress redirect to the Amazon competition

Finding the source of the Amazon redirect and removing it permanently can sometimes be difficult. Redirects can be triggered in several places.

You can find an overview of the possible manipulations here. In addition, care should be taken to remove all backdoors left behind by the hack.

Click "Allow" if you are not a robot (I am not a robot)

The redirect loop ending on the competition (consisting of several "I am not a robot" messages) is a sure sign that the website you actually want to visit has been hacked.
If you are the site owner yourself, you should act immediately so as not to scare off potential visitors.

A general guide to WordPress virus removal:
https://website-bereinigung.de/wordpress-gehackt

Sometimes the site owners are not yet aware of the infection, and contact should be made through another channel to draw attention to the issue.

Under no circumstances click "Allow" - you are not a robot - and do not enter any personal data for the fake search contest.

Where is the script virus hiding and how can it be removed?

This varies greatly from case to case. If you are lucky, it only needs to be removed from the database. In that case, all WordPress pages/posts contain a <script> injection in the wp_posts table, which redirects the page visit. In more serious cases, all files on the web space are affected. These can be PHP, JavaScript, or HTML files.
Modified .htaccess files can also be the cause of the website competition redirect.

You can find a more detailed article on the topic here.
It includes, among other things, a useful SQL command for removing script injections from the database.

/!\ Attention: After removing the symptoms, the entry point must also be analyzed and fixed. Otherwise, "You have made the billionth search" could quickly reappear. In a hack, backdoors are usually scattered across the web space. If the cleanup is not complete, reinfection is highly likely.

P.S.: According to a presentation by Google (end of 2019), around 3.5 billion searches are performed every day.

• Previous
• Next