I’ve olso noticed that the ip 40.77.167.172 is a verified bingbot.
Do you have any idea?
This is related to this ticket [1].
What is this?
Bingbot [2] is crawling your website and in the process, requesting WordPress to clear the oEmbed cache [3].
Is this a virus attack?
No, it is not.
How can I solve?
You can do one or more of the following things:
- Disable WordPress oEmbed API [4]
- Block Bingbot from accessing your website [5]
- Disable alerts for
oembed_cache in the plugin settings
[1] https://ww.wp.xz.cn/support/topic/issues-with-spamming-post-updates/
[2] https://www.bing.com/toolbox/verify-bingbot
[3] https://oembed.com
[4] https://kinsta.com/knowledgebase/disable-embeds-wordpress/
[5] https://blogs.bing.com/webmaster/2012/05/03/to-crawl-or-not-to-crawl-that-is-bingbots-question
Hi,
Now i’m reciving tons of email like this from many sources such as google bot, analytics sites and others:
IP Address: 66.249.64.90
Reverse IP: crawl-66-249-64-90.googlebot.com
Date/Time: 3 March 2018 1:20
Message: Post status has been changed; details: ID: 7841,Old status: new,New status: publish,Title: HEREISTITLE
All with the title HEREISTITLE.
Is this something like the oambed alert?
What is this?
Is it a virus?
What can I do?
Many thanks.
Davide
Is this something like the oambed alert?
It doesn’t looks like it.
What is this?
To me, this looks like the result of a successful SEO spam injection.
There are hundreds of posts on WordPress sites with the title HEREISTITLE and content HEREISCONTENT, most of them created at the beginning of 2016. Some of them contain obfuscated links pointing to other websites full of generic spam, others are completely empty. I believe they are all acting as a beacon to notify the attacker that a website is vulnerable to SEO spam, they will sell this list of websites to whoever is interested to serve malicious ads or unrelated content to promote their own products/services.
Is it a virus?
It is the symptom of an attack commonly known as SEO poisoning spam [1].
What can I do?
- Disable any form that you are not currently controlling;
- Install and enable a comment moderation tool to filter malicious text;
- Read about Akismet [2] and how to configure it to protect your site;
- Remove all suspicious published and unpublished/draft pages and posts;
- Consider to install a web application firewall [3] to prevent reinfections.
[1] https://blog.sucuri.net/2012/11/website-malware-seo-poisoning.html
[2] https://akismet.com
[3] https://www.google.ca/search?q=web+application+firewall
