: How can I scan a HTML website for malicious links/scripts? I designed a website using a free HTML templates. Up until now I used to trust the free templates I found online... Recently, one

@Angie530

I use xenu link sleuth to crawl websites for broken links but it would also tell you outbound links.

If you are using files with the js extension then you might also want to look at the source.

Another possibility is that a Google Analytics Spam bot or other Bad Bots crawled your site and such bots showed up in your analytics data. You can filter those out of you site data in Google Analytics.

Vote Up Vote Down

@Nickens628

Is there a simple way (not through command lines, ideally) to scan the website's files, or a list of the processes which are launched when one accesses the site, to troubleshoot where such malicious code snippet is located?


I ran your site through webpagetest.org and the results are here:
www.webpagetest.org/result/150721_YH_191X/1/details/
There you will see that a chrome web browser from Montreal Quebec Canada accessed your site once and attempted to load every file that is part of it. Items highlighted in red indicate files your HTML requested that were not found.

Then youll have to check each of those files individually (mainly ones ending in .js) for anything that refers to the malicious links. start by searching each file listed for "http://" or "https://" or even "www.", or better yet, if you know actual URLs of the malicious links, search for the URL or even the domain. Many Text editors have a find text functionality built in.

If you have found something and its inside third-party code such as jquery, then download the code again from the original source, not an untrusted third-party source.

As far as just receiving visits from Russia, Its quite possible that someone is using a proxy and connecting to the internet through it and then connecting to your site via the proxy. Webpagetest.org gives users the ability to test any website from servers in Russia.

If the visitors from Russia you speak of happen to have the same IP address and they always cause a problem and you're certain none are genuine guests, then you can safely block the IP address.

Vote Up Vote Down

@Si4351233

Spammy looking visits are unlikely to be due to the code on your site. A lot of website are affected by this spam traffic, usually lasting less than 10 seconds with a bounce rate around 100%.

These visits are often a traffic generation strategy to trick webmasters to look at the referral source for the visits, usually these redirect to some sort of purchase page / affiliate site.

Unless these visits are eating a load of resource (unlikely) then there's no real issue here other than skewing stats in Google Analytics. If you can determine the IP addresses of these visits you can filter them from your GA reports - support.google.com/analytics/answer/1034840?hl=en

Vote Up Vote Down