Website Redirect Issue

[Philip Shaw]

Good morning. This might be a little off-base but it might have affected some of you in the past (or future). I just found out that if a customer finds me in Google and clicks on the Website link it redirects them to a Hummer parts website. If I hover over the Website option it lists my correct URL. I don't know how long this has been going on but I have noticed less traffic for the last few weeks. I went into my Google Business profile and it has the correct URL. The company that does my web page says things look okay on their end. Has anybody experienced something like this or have any suggestions?

Thanks.

[RecuperoDati299]

maybe You should share your website link :-)

Ottieni BlueMail per cellulari

Il giorno 21 maggio 2026, alle ore 14:39, Philip Shaw <datarecovery...@googlegroups.com> ha scritto:

Good morning. This might be a little off-base but it might have affected some of you in the past (or future). I just found out that if a customer finds me in Google and clicks on the Website link it redirects them to a Hummer parts website. If I hover over the Website option it lists my correct URL. I don't know how long this has been going on but I have noticed less traffic for the last few weeks. I went into my Google Business profile and it has the correct URL. The company that does my web page says things look okay on their end. Has anybody experienced something like this or have any suggestions?

Thanks.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkbuRbE-U0bRPnmOFV%3D%3DVqhkbPVm%3DSwAEyUh_JRciABSYg%40mail.gmail.com.

[Luke Coughey]

Can I assume your using a wordpress site?  I had the issue where code was inserted into my site that would do that very thing, but it was not consistent.  That is, if I went to the site directly, it wouldn't redirect, but if I was going to it from a google search, it would, some of the time. Very frustrating. I was paying for apps to keep my code clean for too long and finally decided to flip my site to a static php site last month.

Luke Coughey

CEO

Recovery Force Inc

866-750-3169

http://www.recoveryforce.com

This e-mail is intended solely for the person or entity it is sent to and may contain confidential and/or privileged information.  Any review, dissemination, reproduction or other use of this e-mail by persons or entities other than the intended addressee is prohibited.  If you have received this e-mail in error, please contact the sender immediately and delete and destroy this message, all attached material and all electronic reference from all computing based devices.

On Thu, May 21, 2026 at 8:39 AM Philip Shaw <shawcomput...@gmail.com> wrote:

Good morning. This might be a little off-base but it might have affected some of you in the past (or future). I just found out that if a customer finds me in Google and clicks on the Website link it redirects them to a Hummer parts website. If I hover over the Website option it lists my correct URL. I don't know how long this has been going on but I have noticed less traffic for the last few weeks. I went into my Google Business profile and it has the correct URL. The company that does my web page says things look okay on their end. Has anybody experienced something like this or have any suggestions?

Thanks.

--

[Philip Shaw]

Yes, I believe they use Wordpress. The correct URL is scsdatarecovery.com. That seems to work fine. If a local customer Googles data recovery near me or Shaw Computer Services and then clicks on the Website link it redirects them to another site. It's not like it is even beneficial for a Hummer parts seller to get people in need of data recovery but I am pretty pissed off.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbEQ3UW9v9nz-UEse_Jaony0eYthatCWP1%2BC8_UDutuO8w%40mail.gmail.com.

[Data Recovery Guru]

I just clicked on your link and it took me to the Hummer hihihaha parts website.

DATARECOVERYGURU TEAM

(617) 571-9172

www.datarecoveryguru.com

Offices are open Mon-Fri 9AM to 4:30PM. 

Available by appointment outside business hours.

Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026

Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803

Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701

Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903

New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://rumble.com/

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkarUSe1u6LfSt2dZHCkLRQFJkjGw0o72G80qEtRUSDSiw%40mail.gmail.com.

[Philip Shaw]

Thus the reason for this post.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAHoXmqk7r-Z1mEYXHEUZ9m7h2GPS6z6_uN-hLyXiBpOfR8m4gg%40mail.gmail.com.

[Data Recovery Guru]

Where are you located? I would like to type in Google data recovery + your city country and see if you website pops up and then click on the link.

DATARECOVERYGURU TEAM

(617) 571-9172

www.datarecoveryguru.com

Offices are open Mon-Fri 9AM to 4:30PM. 

Available by appointment outside business hours.

Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026

Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803

Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701

Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903

New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://rumble.com/

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkao0OKU02Hcf8To5uOEB3D4XEW2K%3DF8A48xfwB9mhU%3Djg%40mail.gmail.com.

[Desert Data Recovery]

Yep.  Hummer website for me too. Might you have been hacked somehow and someone has set redirects.  

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkao0OKU02Hcf8To5uOEB3D4XEW2K%3DF8A48xfwB9mhU%3Djg%40mail.gmail.com.

[Philip Shaw]

I am located in Ellicott City, Maryland,

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAOasWzsrJWGctLyy6tiNiq_wo0dS4HREjmSyDbOZbqz21cVEcQ%40mail.gmail.com.

[DiskTuna]

[Data Recovery Guru]

I googled "Data Recovery Ellicott City" on Google Maps on an Android.

Your Google listing popped up, clicked on it, then clicked on the website. It took me to your correct website via Chrome. That worked fine.

DATARECOVERYGURU TEAM

(617) 571-9172

www.datarecoveryguru.com

Offices are open Mon-Fri 9AM to 4:30PM. 

Available by appointment outside business hours.

Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026

Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803

Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701

Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903

New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://rumble.com/

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/976e308f-bc14-4510-b074-0059031b625en%40googlegroups.com.

[DiskTuna]

This is what I did, and when clicked I get to proper website. But look at the Google listing!!

[Alandata Recovery]

This happened to me years ago 

Someone told the hummer dealer they could boost his traffic. 

Plug-ins are sometimes sold to crooks.

You have a popular chat plug in. The new owner updates the plug in with new features. Like if traffic is direct show real website. If it came from search show Viagra website. 

Easiest fix is to revert to a backup and find the malware.

...

On further inspection...

It's probably phishing for cc not parts. It's fraud. No contact numbers. No sales tax. New domain. No reviews.....

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"

www.alandata.com   www.alandataRecovery.com

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/7b3965a6-4fef-4d0d-a374-c5328e58d3e7n%40googlegroups.com.

[Alandata Recovery]

Grok says ..

**Yes, this is a classic sign of domain compromise/hijacking.** 

Your friend's original **Shaw Computer Services / SCS Data Recovery** site (a legitimate local data recovery business in Ellicott City, MD, run by Philip Shaw) has been overtaken. The homepage still shows the old data recovery content and testimonials, but the site is now serving random product listings (sunglasses, car parts, tools, clothing, etc.) with the same suspicious e-commerce setup as **thriftthumb.com** (and the typo "thriftrhumb").

### What's happening:

- The domain `scsdatarecovery.com` is being **redirected or overlaid** with a dropshipping-style scam store (same footer "SCSDATARECOVERY.COM, LLC", product pages, etc.).

- This is common: Hackers gain access (via weak password, outdated CMS/plugin, compromised hosting, or email), change DNS/settings, and turn the domain into a fake shop to sell junk, steal card details, or drop-ship low-quality goods.

- The business itself appears real and has positive reviews on local directories (Angie's List, Yelp, Thumbtack, etc.) going back years.

### What your friend should do immediately:

1. **Contact their domain registrar** (check WHOIS for the current one) and hosting provider right away. They need to regain control, reset passwords, and secure the account.

2. **Change all passwords** (domain, hosting, email, FTP, admin panels) from a clean device.

3. **Check for malware/backdoors** and consider professional cleanup.

4. **Temporarily take the site offline** or redirect to a holding page if needed.

5. Monitor for unauthorized charges/transactions if any payments were set up.

6. Update security: Enable 2FA everywhere, use strong unique passwords, keep software updated.

If they need help finding contact info for the registrar/host, they can look it up via a WHOIS tool (e.g., whois.com or ICANN lookup).

This is **not** a legit operation on their end anymore — it's been hijacked. Advise your friend to act fast before Google flags it or more damage occurs. Let me know if they need specific next steps!

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"

www.alandata.com   www.alandataRecovery.com

[img]

Just for the record: I found https://www.scsdatarecovery.in/ but this is a standalone business in India, there's no coincidence with this incident.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAH-%2BjWRe3W37VSG8%2BXF0F-Xi7sbe%2BQHd1C%3Dr6AaO%2BPhKPqmuXQ%40mail.gmail.com.

[Marcos Santos]

virustotal.com didn't detect anything abnormal.

It's probably a problem with some WordPress plugin.

[RecuperoDati299]

Hello

I can suppose It Is a DNS server issue

they are several around the world and from Italia the website 

http://scsdatarecovery.com/

or 

https://scsdatarecovery.com/

either with 'www'

opens correctly 

I can suggest an AI approach with claude.ai

write a comprehensive prompt describing the issue and possibly the engine or CMS behind your website 

and add my info above

let's see what feedback you'll get

R.

Ottieni BlueMail per cellulari

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkarUSe1u6LfSt2dZHCkLRQFJkjGw0o72G80qEtRUSDSiw%40mail.gmail.com.

[pbzcbf...@gmail.com]

http://scsdatarecovery.com/ redirects to Hummer.

https://scsdatarecovery.com/ works fine.

The difference is HTTP versus HTTPS.

[RecuperoDati299]

this reinforce the hypothesis of DNS issues 

Ottieni BlueMail per cellulari

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/66e23601-fff2-4ace-9745-436c40e22233n%40googlegroups.com.

[RecuperoDati299]

I would suggest to inquire your service provider 

open a ticket and ask to resubmit the DNS entries

Ottieni BlueMail per cellulari

Il giorno 21 maggio 2026, alle ore 19:13, pbzcbf...@gmail.com <datarecovery...@googlegroups.com> ha scritto:

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/66e23601-fff2-4ace-9745-436c40e22233n%40googlegroups.com.

[pbzcbf...@gmail.com]

If I r-click and save either URL, I get the same text file:

<!DOCTYPE html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
<title>Hihaha Suspension Ride Height Level Sensor - Pair For Hummer H2 2003-2009 (Left &amp; Right, Rear)</title>
<meta http-equiv="refresh" content="0; url=https://www.thriftthumb.com/product-p-938525.html">
<script>
  try {
    window.location.replace("https://www.thriftthumb.com/product-p-938525.html");
  } catch (e) {
    window.location.href = "https://www.thriftthumb.com/product-p-938525.html";
  }
</script>
</head><body></body></html>

[Philip Shaw]

Pb, both of those go to my web site when I click on them.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/f5748c8a-c98b-4b49-a846-d68664c4033bn%40googlegroups.com.

[pbzcbf...@gmail.com]

The redirected URL appears to be clean.

https://www.virustotal.com/gui/url/cf1d703173647a968a752d17b7b5fa68bed6183fd907a47f1a6bcddcf642f668?nocache=1

[Alandata Recovery]

direct link works for me both

searching through google.....

the plugin looks at the referrer and then redirects

this helps hide it from the owner..

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkaVaUB0Q1AA_0Nix-51-W6QxZbMT53zBE-m7ktvDr40mA%40mail.gmail.com.

--

[pbzcbf...@gmail.com]

As expected, the Thrift site raises red flags.

https://www.scam-detector.com/validator/thriftthumb-com-review/

https://gridinsoft.com/online-virus-scanner/url/thriftthumb-com

[Philip Shaw]

Does the consensus seem to be that this has something to do with Wordpress? The company that handles my web page says they can load an old (hopefully clean) copy of the web page or build a new page from scratch. I just don't want to waste the time and money and find out it was something else.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/f138c639-e402-45b6-8bcc-485c9cf092a7n%40googlegroups.com.

[pbzcbf...@gmail.com]

I don't know what the following info is telling us. Maybe it's irrelevant.

C:\WINDOWS\system32>ping scsdatarecovery.com

Pinging scsdatarecovery.com [64.29.151.221] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 64.29.151.221:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),





https://www.whois.com/whois/64.29.151.221

Whois IP 64.29.151.221
Updated 6 days ago

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2026, American Registry for Internet Numbers, Ltd.
#


NetRange:       64.29.144.0 - 64.29.159.255
CIDR:           64.29.144.0/20
NetName:        MEGA-2
NetHandle:      NET-64-29-144-0-1
Parent:         NET64 (NET-64-0-0-0-0)
NetType:        Direct Allocation
OriginAS:      
Organization:   Internet Names For Business Inc. (INB-25)
RegDate:        2002-02-14
Updated:        2023-06-27
Ref:            https://rdap.arin.net/registry/ip/64.29.144.0


OrgName:        Internet Names For Business Inc.
OrgId:          INB-25
Address:        619A Kumpf Drive
City:           Waterloo
StateProv:      ON
PostalCode:     N2V 1K8
Country:        CA
RegDate:        2023-04-24
Updated:        2025-06-30
Ref:            https://rdap.arin.net/registry/entity/INB-25


OrgTechHandle: ZI51-ARIN
OrgTechName:   InternetNamesForBusiness
OrgTechPhone:  +1-800-322-9438
OrgTechEmail:  em...@internetnamesforbusiness.com
OrgTechRef:    https://rdap.arin.net/registry/entity/ZI51-ARIN

OrgNOCHandle: ZI51-ARIN
OrgNOCName:   InternetNamesForBusiness
OrgNOCPhone:  +1-800-322-9438
OrgNOCEmail:  em...@internetnamesforbusiness.com
OrgNOCRef:    https://rdap.arin.net/registry/entity/ZI51-ARIN

OrgDNSHandle: ZI51-ARIN
OrgDNSName:   InternetNamesForBusiness
OrgDNSPhone:  +1-800-322-9438
OrgDNSEmail:  em...@internetnamesforbusiness.com
OrgDNSRef:    https://rdap.arin.net/registry/entity/ZI51-ARIN

OrgAbuseHandle: ZI51-ARIN
OrgAbuseName:   InternetNamesForBusiness
OrgAbusePhone:  +1-800-322-9438
OrgAbuseEmail:  em...@internetnamesforbusiness.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/ZI51-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/resources/registry/whois/tou/
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
#
# Copyright 1997-2026, American Registry for Internet Numbers, Ltd.
#




https://64.29.151.221/index.html


Be careful. Something doesn’t look right.

Firefox spotted a potentially serious security issue with 64.29.151.221. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails.

Advanced

What makes the site look dangerous?

The site is set up to allow only secure connections, but there’s a problem with the site’s certificate. It’s possible that a bad actor is trying to impersonate the site. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because its certificate isn’t valid for 64.29.151.221. The certificate is only valid for: *.carrierzone.com, carrierzone.com.

What can you do about it?

Probably nothing, since it’s likely there’s a problem with the site itself. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. But if you’re on a corporate network, your support team may have more info. If you’re using antivirus software, try searching for potential conflicts or known issues.

View the site’s certificate

Learn more about secure connection failures

Error Code: SSL_ERROR_BAD_CERT_DOMAIN

May 22, 2026 4:05:34 AM GMT+10




https://64.29.151.221/index.html

Unable to communicate securely with peer: requested domain name does not match the server’s certificate.

HTTP Strict Transport Security: false
HTTP Public Key Pinning: false



Certificate

Subject Name
Common Name  *.carrierzone.com

Issuer Name
Country  GB
Organization  Sectigo Limited
Common Name  Sectigo Public Server Authentication CA DV R36

Validity
Not Before
Fri, 01 May 2026 00:00:00 GMT
Not After  Sun, 15 Nov 2026 23:59:59 GMT

Subject Alt Names
DNS Name  *.carrierzone.com
DNS Name  carrierzone.com





https://www.carrierzone.com/index.html

About carrierzone

carrierzone is committed to protecting your network of outsourced web, email and e-commerce against abuse with our robust system of abuse management technologies and services. We actively support the efficient network operation of small and medium sized business web sites, email services and related applications. Our solutions are used exclusively by hosting service providers, such as ISP's, telco's, cable companies, domain registrars, and other web service providers.

carrierzone is committed to providing a professionally managed outsourced email abuse solution. We take over your abuse mail and remove the spammers and abusers. Service providers on our system can concentrate on running the best email and web services and service their end-users while we manage the problem areas such as network-affecting SPAM and other abuse categories.

[pbzcbf...@gmail.com]

More irrelevant info?

https://www.internetnamesforbusiness.com/

"Internet Names for Business is a domain registration and administration service working exclusively with affiliated web hosting providers. To register a domain name please visit your web hosting provider’s website and click on the designated link."

[pbzcbf...@gmail.com]

FWIW, these are the saved web site copies at the Wayback Machine. The most recent is dated March 13, 2026.

https://web.archive.org/web/20240515000000*/https://scsdatarecovery.com/

https://web.archive.org/web/20260313112741/https://scsdatarecovery.com/ (most recent)

[RecuperoDati299]

I must suppose that my previous message has not been read

In Italy the website opens fine

this is more likely an issue with DNS servers around the world

see attachment 

Regards

Ottieni BlueMail per cellulari

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/ffd14bf3-9ace-43f7-a337-9587bbdb0089n%40googlegroups.com.

[Philip Shaw]

The Italian version opens from the website link on a Google search?

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/adc4101d401e78.2104c4a355e73a%40gmail.com.

[compos mentis]

If you r-click the SCS URL and save it to a file, what do you see when you open the file in NotePad? This would normally be the "index.html" file contents on the home page.

[compos mentis]

If you ping the SCS domain at a DOS prompt, what IP address does it resolve to?

Are you saying that different DNS servers may resolve the SCS domain to different IP addresses?

On 22-May-26 5:23 AM, RecuperoDati299 wrote:

[Alandata Recovery]

C:\Windows\system32>ping scsdatarecovery.com

Pinging scsdatarecovery.com [64.29.151.221] with 32 bytes of data:
Request timed out.

Ping statistics for 64.29.151.221:
    Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
^C
C:\Windows\system32>
C:\Windows\system32>tracert scsdatarecovery.com

Tracing route to scsdatarecovery.com [64.29.151.221]
over a maximum of 30 hops:

  1     1 ms     1 ms     1 ms  192.168.1.1
  2     *        *        *     Request timed out.
  3     3 ms     4 ms     3 ms  wsip-64-58-163-2.oc.oc.cox.net [64.58.163.2]
  4     *        *        *     Request timed out.
  5    14 ms    14 ms    15 ms  lax-b23-link.ip.twelve99.net [62.115.13.102]
  6     *        *        *     Request timed out.
  7     7 ms    16 ms    11 ms  be3359.ccr42.lax01.atlas.cogentco.com [154.54.3.69]
  8    14 ms    14 ms    15 ms  be2932.ccr32.phx01.atlas.cogentco.com [154.54.45.161]
  9    23 ms    23 ms    23 ms  be5473.ccr22.elp02.atlas.cogentco.com [154.54.166.69]
 10    35 ms    35 ms    35 ms  be3846.ccr32.dfw01.atlas.cogentco.com [154.54.165.29]
 11    51 ms    53 ms    51 ms  port-channel8122.ccr92.jan02.atlas.cogentco.com [154.54.41.54]
 12    68 ms    67 ms     *     be8473.ccr82.mia03.atlas.cogentco.com [154.54.5.162]
 13    68 ms    67 ms    71 ms  be8078.ccr22.mia01.atlas.cogentco.com [154.54.170.89]
 14    68 ms    67 ms    71 ms  be8159.rcr61.b053027-0.mia01.atlas.cogentco.com [154.54.170.194]
 15    68 ms    67 ms    68 ms  38.32.118.15
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/0b9f2086-3f08-44d5-9fa6-943ebfecf323%40gmail.com.

[pbzcbf...@gmail.com]

I would examine the index.html file in the root of the server. Alternatively, other names for the home page could be index.htm, index.php, default.htm, etc. The owner can specify the actual home page in the .htaccess file. This file is protected, so we can't see it.

[RecuperoDati299]

Hello

I have missed the part that this happens only clicking on the Google SERP

This distinction 

- direct URL works

- access from search engine , doesn't work

is a confirmation 

if your website rely on WordPress, there is an hacking that may have affected your WordPress , and it should.

I mean that your website has been compromised.

This is a very common cyber infection known as a "Conditional Redirect" (or Google Redirect Hack). 

The malicious code, which has been injected into the site's files, is programmed to behave differently based on the visitor's origin:

1. Analyzes the HTTP_REFERER: The server checks where the user is coming from.

2. Access from Google: If the header indicates that the click comes from a search engine, the malware executes a redirect to a third-party site (usually to generate illicit traffic or scams).

3. Direct access: If the URL is typed manually, the Referer field is empty. The malware allows the site to load regularly. 

This serves the attackers to hide the issue from the site owner for as long as possible.

You have three quick fixes to try it this order

1. get a copy of the file .htaccess good for WordPress from the web and overwrite the current one. Test

2. get a copy of the main index.php file from the same WordPress version package and overwrite (don't reinstall, don't update/upgrade). Test

3. switch temporarily to another template. Test. If this works, they must manage to remove it, wipe it's files and install it again as fresh and clean install

if these doesn't fix, well it is matter of additional mutations made in other files (would be weird though) 

in this case, dump the DB behind WordPress and save it as backup 

save, if any, your template directory 

then ask the wipe and reinstall of WordPress + plugins + template, since it would be quicker than seek for a fix

Regards

Roberto @ RecuperoDati299 

Italia

Ottieni BlueMail per cellulari

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkbtck1WAaOkCTOgDunMZDC0xmtO_SYEVg2ZFGnLo26zyg%40mail.gmail.com.

[Luke Coughey]

After this long thread, we are still at what I said at the beginning. If it is a wordpress site, it is likely hijacked with inserted code that only does the redirect when coming in from an outside link, usually google search.  The only way I was able to address it was to get a plugin service to search my site, find the malicious code and remove it. However, it will keep coming back without then paying for a plug to watch for and block it.

And, as I said, I got tired of paying for that, so I just completely redid my website into static php pages, dropping WordPress completely.

Luke Coughey

CEO

Recovery Force Inc

866-750-3169

http://www.recoveryforce.com

This e-mail is intended solely for the person or entity it is sent to and may contain confidential and/or privileged information.  Any review, dissemination, reproduction or other use of this e-mail by persons or entities other than the intended addressee is prohibited.  If you have received this e-mail in error, please contact the sender immediately and delete and destroy this message, all attached material and all electronic reference from all computing based devices.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/b26a48722d8938.1fa6c6e6947a7e%40gmail.com.

[Philip Shaw]

Yes, it does look like it was an old plugin in Wordpress that was the culprit. A new page has been loaded and seems to be working fine although there is some verbiage I want to change. Beware if you are using Wordpress for your web page. 

Using ping and tracert on the web address still don't return good results. I'm not sure what that means.

Thanks to all of you for your help on this issue. I figured with the talent on this email list I would get an answer and Luke nailed it early and there were a lot of other great suggestions.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbEDtrUSH4MMrTTwdvXSOTtHHM8fAjCbzafUO3h394W-gw%40mail.gmail.com.

[RecuperoDati299]

You welcome 

Ottieni BlueMail per cellulari

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkbj48E%2B5YGoQgA35ygzSY0SKjh%3D8J%2Bj_R3oDb4_evdJOg%40mail.gmail.com.

[compos mentis]

It looks like you are now on version 7.0. This was released on May 20, 2026.

https://en.wikipedia.org/wiki/WordPress#Release_history

<link rel="https://api.w.org/" href="https://scsdatarecovery.com/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://scsdatarecovery.com/wp-json/wp/v2/pages/2" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://scsdatarecovery.com/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 7.0" />