{"id":207,"date":"2026-01-13T00:00:00","date_gmt":"2026-01-12T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/hu\/googlebot-ip-tartomanyokra-epito-wordpress-cloaking-malware\/"},"modified":"2026-01-20T06:32:33","modified_gmt":"2026-01-20T05:32:33","slug":"googlebot-ip-tartomanyokra-epito-wordpress-cloaking-malware","status":"publish","type":"post","link":"https:\/\/helloblog.io\/hu\/googlebot-ip-tartomanyokra-epito-wordpress-cloaking-malware\/","title":{"rendered":"Googlebotra c\u00e9loz, neked l\u00e1thatatlan: IP-tartom\u00e1nyokra \u00e9p\u00edt\u0151 WordPress cloaking malware"},"content":{"rendered":"\n<p>Az egyik legkellemetlenebb WordPress-es fert\u0151z\u00e9s az, amit nem is nagyon tudsz \u201e\u00e9szrevenni\u201d. A site neked \u00e9s a norm\u00e1l l\u00e1togat\u00f3knak rendben bet\u00f6lt, nincs l\u00e1tv\u00e1nyos \u00e1tir\u00e1ny\u00edt\u00e1s, nem ugrik fel gyan\u00fas popup \u2013 k\u00f6zben viszont a keres\u0151motorok (k\u00fcl\u00f6n\u00f6sen a Google) teljesen m\u00e1s tartalmat kapnak. Ennek eredm\u00e9nye tipikusan SEO-spam, indexel\u00e9si k\u00e1osz, reput\u00e1ci\u00f3roml\u00e1s, rosszabb esetben feketelist\u00e1z\u00e1s.<\/p>\n\n\n\n<p>A Sucuri egy olyan esetr\u0151l \u00edrt, ahol a t\u00e1mad\u00f3k nem el\u00e9gedtek meg a szok\u00e1sos, k\u00f6nnyen hamis\u00edthat\u00f3 User-Agent sz\u0171r\u00e9ssel. A malware a Google infrastrukt\u00far\u00e1j\u00e1hoz tartoz\u00f3 IP-tartom\u00e1nyokat is ellen\u0151rizte (r\u00e1ad\u00e1sul IPv4 \u00e9s IPv6 eset\u00e9n is), \u00e9s csak akkor szolg\u00e1lta ki a rejtett payloadot, ha a k\u00e9r\u00e9st t\u00e9nyleg \u201eigazi\u201d Googlebotnak gondolta.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mi t\u00f6rt\u00e9nt a gyakorlatban? Index.php mint kapu\u0151r<\/h2>\n\n\n\n<p>A vizsg\u00e1lt fert\u0151z\u00e9s a WordPress oldal f\u0151 bel\u00e9p\u00e9si pontj\u00e1ba, az <code>index.php<\/code> f\u00e1jlba ker\u00fclt. Ez k\u00fcl\u00f6n\u00f6sen vesz\u00e9lyes hely: ha a t\u00e1mad\u00f3 itt d\u00f6nt arr\u00f3l, hogy mi fusson le, akkor gyakorlatilag a teljes alkalmaz\u00e1s ind\u00edt\u00e1sa el\u0151tt tud szelekt\u00e1lni.<\/p>\n\n\n\n<p>A logika l\u00e9nyege: a m\u00f3dos\u00edtott <code>index.php<\/code> el\u0151sz\u00f6r azonos\u00edtani pr\u00f3b\u00e1lja a l\u00e1togat\u00f3t. Ha \u201e\u00e1tlagos\u201d felhaszn\u00e1l\u00f3 vagy, a WordPress a megszokott m\u00f3don szolg\u00e1l ki. Ha viszont a l\u00e1togat\u00f3 egy keres\u0151robotnak t\u0171nik, akkor a t\u00e1mad\u00f3 \u00e1ltal megadott k\u00fcls\u0151 forr\u00e1sb\u00f3l t\u00f6lt be tartalmat, \u00e9s azt adja vissza a robotnak \u2013 mintha az az oldal saj\u00e1t tartalma lenne.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1360\" height=\"636\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic.png\" alt=\"\u00c1ttekint\u0151 \u00e1bra az IP-ellen\u0151rz\u00e9ssel kombin\u00e1lt felt\u00e9teles logik\u00e1r\u00f3l\" class=\"wp-image-199\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic.png 1360w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic-1024x479.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic-768x359.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/IP-Verified-Conditional-Logic-400x187.png 400w\" sizes=\"auto, (max-width: 1360px) 100vw, 1360px\" \/><figcaption class=\"wp-element-caption\">A t\u00e1mad\u00e1s szelekt\u00edven d\u00f6nt: tiszta oldal a felhaszn\u00e1l\u00f3nak, k\u00fcls\u0151 payload a robotnak. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Mi\u00e9rt \u00fajdons\u00e1g ez? Nem csak User-Agent alapj\u00e1n sz\u0171r<\/h2>\n\n\n\n<p>A cloaking (amikor a keres\u0151robot m\u00e1st l\u00e1t, mint a felhaszn\u00e1l\u00f3) nem \u00faj tr\u00fckk. Az viszont ritk\u00e1bb, hogy a t\u00e1mad\u00f3 ennyire \u201eprec\u00edzen\u201d azonos\u00edt: a script egy nagy, hardcode-olt list\u00e1t tartalmazott Google ASN-hez (Autonomous System Number) k\u00f6thet\u0151 IP-tartom\u00e1nyokr\u00f3l CIDR form\u00e1tumban.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ASN r\u00f6viden: mit jelent, \u00e9s mi\u00e9rt fontos?<\/h3>\n\n\n\n<p>Az ASN (Autonomous System Number) l\u00e9nyeg\u00e9ben egy h\u00e1l\u00f3zati \u201eazonos\u00edt\u00f3\u201d az interneten: IP-c\u00edmblokkok \u00e9s \u00fatvonalak szervez\u0151dnek al\u00e1, tipikusan nagy szolg\u00e1ltat\u00f3khoz (p\u00e9ld\u00e1ul Google) kapcsol\u00f3dva. Ha egy k\u00e9r\u00e9s a Google ASN-hez tartoz\u00f3 h\u00e1l\u00f3zatb\u00f3l \u00e9rkezik, az j\u00f3 es\u00e9llyel val\u00f3di Google infrastrukt\u00fara \u2013 nem csak valaki, aki be\u00edrta a User-Agentbe, hogy Googlebot.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CIDR: hogyan \u00edrunk le IP-tartom\u00e1nyt t\u00f6m\u00f6ren?<\/h3>\n\n\n\n<p>A CIDR (Classless Inter-Domain Routing) egy t\u00f6m\u00f6r jel\u00f6l\u00e9s IP-tartom\u00e1nyokra. P\u00e9ld\u00e1ul a <code>192.168.1.0\/24<\/code> azt jelenti, hogy a <code>192.168.1.0<\/code>\u2013<code>192.168.1.255<\/code> tartom\u00e1ny egy blokk. A perjel ut\u00e1ni sz\u00e1m (itt 24) a h\u00e1l\u00f3zati maszk m\u00e9ret\u00e9t adja meg, vagyis hogy mekkora a tartom\u00e1ny.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1332\" height=\"620\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format.png\" alt=\"CIDR form\u00e1tumot magyar\u00e1z\u00f3 \u00e1bra\" class=\"wp-image-200\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format.png 1332w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format-1024x477.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format-768x357.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/CIDR-format-400x186.png 400w\" sizes=\"auto, (max-width: 1332px) 100vw, 1332px\" \/><figcaption class=\"wp-element-caption\">A CIDR jel\u00f6l\u00e9s azt mutatja meg, mekkora IP-blokkot fed le a tartom\u00e1ny. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Hogyan m\u0171k\u00f6dik a malware? T\u00f6bbr\u00e9teg\u0171 ellen\u0151rz\u00e9s \u00e9s t\u00e1voli tartalom bet\u00f6lt\u00e9se<\/h2>\n\n\n\n<p>A minta alapj\u00e1n ez a fert\u0151z\u00e9s egy klasszikus \u201ekapu\u0151r\u201d (gatekeeper) megold\u00e1s: t\u00f6bb l\u00e9p\u00e9sben pr\u00f3b\u00e1lja biztos\u00edtani, hogy csak a megfelel\u0151 c\u00e9lpont (Google robot \u00e9s kapcsol\u00f3d\u00f3 eszk\u00f6z\u00f6k) kapja meg a rejtett tartalmat.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) T\u00f6bbl\u00e9pcs\u0151s azonos\u00edt\u00e1s: User-Agent + IP valid\u00e1l\u00e1s<\/h3>\n\n\n\n<p>Els\u0151 k\u00f6rben a script megn\u00e9zi a <code>HTTP_USER_AGENT<\/code> fejl\u00e9cet. A User-Agent egy sz\u00f6veg, amit a b\u00f6ng\u00e9sz\u0151 (vagy crawler) minden k\u00e9r\u00e9sn\u00e9l elk\u00fcld, \u00e9s tipikusan tartalmazza, hogy milyen kliensr\u0151l, eszk\u00f6zr\u0151l, oper\u00e1ci\u00f3s rendszerr\u0151l van sz\u00f3. Ezt nagyon k\u00f6nny\u0171 hamis\u00edtani, ez\u00e9rt j\u00f6n a m\u00e1sodik l\u00e9p\u00e9s: az IP-tartom\u00e1ny ellen\u0151rz\u00e9se.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"498\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification.png\" alt=\"\u00c1bra a t\u00f6bbr\u00e9teg\u0171 azonos\u00edt\u00e1sr\u00f3l (User-Agent \u00e9s IP ellen\u0151rz\u00e9s)\" class=\"wp-image-201\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification.png 1880w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification-300x79.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification-1024x271.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification-768x203.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification-1536x407.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Multi-Layer-Identity-Verification-400x106.png 400w\" sizes=\"auto, (max-width: 1880px) 100vw, 1880px\" \/><figcaption class=\"wp-element-caption\">A t\u00e1mad\u00f3k a k\u00f6nnyen hamis\u00edthat\u00f3 User-Agentet IP-szint\u0171 ellen\u0151rz\u00e9ssel er\u0151s\u00edtik meg. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2) Bitm\u0171veletes IP-tartom\u00e1ny ellen\u0151rz\u00e9s (IPv4\/IPv6)<\/h3>\n\n\n\n<p>A technikailag \u00e9rdekes r\u00e9sz az, hogy a script nem \u201estring keres\u00e9st\u201d v\u00e9gez IP-c\u00edmekre, hanem sz\u00e1mol: bitm\u0171veletekkel ellen\u0151rzi, hogy a l\u00e1togat\u00f3 IP-je beleesik-e egy adott CIDR tartom\u00e1nyba. A Sucuri p\u00e9ld\u00e1ja IPv4-re ezt a logik\u00e1t mutatja:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ IPv4 h\u00e1l\u00f3zati egyez\u00e9s ellen\u0151rz\u00e9s\u00e9nek alapelve (a Sucuri elemz\u00e9se alapj\u00e1n)\n\/\/ (ip &amp; netmask) == (range &amp; netmask)\n($ip_decimal &amp; $netmask_decimal) == ($range_decimal &amp; $netmask_decimal);\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ IPv4 h\u00e1l\u00f3zati egyez\u00e9s ellen\u0151rz\u00e9s\u00e9nek alapelve (a Sucuri elemz\u00e9se alapj\u00e1n)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ (ip &#x26; netmask) == (range &#x26; netmask)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">($ip_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal) <\/span><span style=\"color:#F97583\">==<\/span><span style=\"color:#E1E4E8\"> ($range_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal);<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>A gyakorlati k\u00f6vetkezm\u00e9ny: ha te manu\u00e1lisan tesztelsz, hi\u00e1ba \u00e1ll\u00edtod \u00e1t a User-Agentet Googlebotra, a payload akkor sem fog megjelenni, mert az IP-d nem a Google h\u00e1l\u00f3zat\u00e1b\u00f3l j\u00f6n. R\u00e1ad\u00e1sul a k\u00f3d IPv6-tal is foglalkozott, amit sok r\u00e9gebbi cloaking script egyszer\u0171en ignor\u00e1l.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1420\" height=\"734\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation.png\" alt=\"\u00c1bra a bitm\u0171veletes IP tartom\u00e1ny valid\u00e1l\u00e1sr\u00f3l\" class=\"wp-image-202\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation.png 1420w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation-300x155.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation-1024x529.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation-768x397.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Bitwise-IP-Range-Validation-400x207.png 400w\" sizes=\"auto, (max-width: 1420px) 100vw, 1420px\" \/><figcaption class=\"wp-element-caption\">Nem csak ellen\u0151riz, hanem \u201esz\u00e1mol\u201d: \u00edgy sokkal nehezebb egyszer\u0171 tr\u00fckk\u00f6kkel lebuktatni. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">3) T\u00e1voli payload bet\u00f6lt\u00e9se cURL-lel<\/h3>\n\n\n\n<p>Ha a l\u00e1togat\u00f3 \u00e1tment az ellen\u0151rz\u00e9sen, a script cURL-lel (PHP-s HTTP kliens) let\u00f6lt egy k\u00fcls\u0151 oldalr\u00f3l tartalmat, majd azt k\u00f6zvetlen\u00fcl a v\u00e1laszba \u00edrja. A vizsg\u00e1lt esetben a t\u00e1voli domain a forr\u00e1s szerint ez volt: <code>hxxps:\/\/amp-samaresmanor[.]pages[.]dev<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1444\" height=\"836\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL.png\" alt=\"\u00c1bra a t\u00e1voli tartalom cURL-es bet\u00f6lt\u00e9s\u00e9r\u0151l\" class=\"wp-image-203\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL.png 1444w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL-300x174.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL-1024x593.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL-768x445.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Remote-Payload-Execution-via-cURL-400x232.png 400w\" sizes=\"auto, (max-width: 1444px) 100vw, 1444px\" \/><figcaption class=\"wp-element-caption\">A Google azt l\u00e1tja, mintha a spam tartalom a saj\u00e1t oldalad r\u00e9sze lenne. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">4) Sz\u00e9les User-Agent sz\u0171r\u00e9s: nem csak \u201eGooglebot\u201d<\/h3>\n\n\n\n<p>A sz\u0171r\u00e9s nem \u00e1ll meg a Googlebot n\u00e9vn\u00e9l. A script t\u00f6bb, Google-h\u00f6z k\u00f6thet\u0151 azonos\u00edt\u00f3t is figyelembe vett (p\u00e9ld\u00e1ul site verification \u00e9s k\u00fcl\u00f6nb\u00f6z\u0151 ellen\u0151rz\u0151\/inspekci\u00f3s eszk\u00f6z\u00f6k). Ez arra utal, hogy a t\u00e1mad\u00f3 c\u00e9lja nem puszt\u00e1n az indexel\u00e9s, hanem az is, hogy a rejtett tartalom a Google k\u00fcl\u00f6nb\u00f6z\u0151 ellen\u0151rz\u00e9si folyamataiban is konzisztensen megjelenjen.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1682\" height=\"554\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering.png\" alt=\"\u00c1bra a r\u00e9szletes User-Agent alap\u00fa sz\u0171r\u00e9sr\u0151l\" class=\"wp-image-204\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering.png 1682w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering-300x99.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering-1024x337.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering-768x253.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering-1536x506.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/User-Agent-Filtering-400x132.png 400w\" sizes=\"auto, (max-width: 1682px) 100vw, 1682px\" \/><figcaption class=\"wp-element-caption\">Min\u00e9l t\u00f6bb Google-eszk\u00f6zt fed le a sz\u0171r\u00e9s, ann\u00e1l stabilabb a cloaking. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">5) Felt\u00e9teles logika, hibakezel\u00e9s \u00e9s napl\u00f3z\u00e1s<\/h3>\n\n\n\n<p>A d\u00f6nt\u00e9si fa kifejezetten \u201e\u00fczembiztosra\u201d van \u00f6sszerakva: ha legit Google User-Agent + legit Google IP, akkor j\u00f6n a payload, \u00e9s a script napl\u00f3zza a sikert. Ha a t\u00e1voli tartalom nem t\u00f6lthet\u0151 be, a botot <code>\/home\/<\/code> fel\u00e9 tereli, hogy ne egy hib\u00e1s oldal ker\u00fclj\u00f6n indexbe. Ha valaki hamis Googlebot (csak User-Agent, de nem Google IP), a k\u00f3d \u201eFake GoogleBot detected\u201d jelleg\u0171 bejegyz\u00e9st k\u00e9sz\u00edt \u00e9s visszair\u00e1ny\u00edt a norm\u00e1l kezd\u0151oldalra. Minden m\u00e1s l\u00e1togat\u00f3 szint\u00e9n a norm\u00e1l oldalra ker\u00fcl.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1694\" height=\"680\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging.png\" alt=\"\u00c1bra a felt\u00e9teles logik\u00e1r\u00f3l \u00e9s napl\u00f3z\u00e1sr\u00f3l\" class=\"wp-image-205\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging.png 1694w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging-300x120.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging-1024x411.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging-768x308.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging-1536x617.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/Conditional-Logic-and-Error-Logging-400x161.png 400w\" sizes=\"auto, (max-width: 1694px) 100vw, 1694px\" \/><figcaption class=\"wp-element-caption\">A malware nem csak sz\u0171r, hanem figyeli is, mennyire m\u0171k\u00f6dik az \u00e1tver\u00e9s. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Mi\u00e9rt f\u00e1j ez ennyire? SEO, reput\u00e1ci\u00f3 \u00e9s k\u00e9sleltetett \u00e9szlel\u00e9s<\/h2>\n\n\n\n<p>Ennek a fert\u0151z\u00e9snek a f\u0151 \u201ehaszna\u201d a t\u00e1mad\u00f3nak SEO-manipul\u00e1ci\u00f3: a Google spam tartalmat l\u00e1t, te meg a saj\u00e1t oldaladat. A tipikus k\u00f6vetkezm\u00e9nyek a forr\u00e1s alapj\u00e1n:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Indexel\u00e9si probl\u00e9m\u00e1k \u00e9s deindexel\u00e9s (elt\u0171n\u0151 oldalak, \u201efurcsa\u201d tal\u00e1latok).<\/li>\n\n\n<li>Keres\u0151motoros feketelist\u00e1z\u00e1s \u00e9s reput\u00e1ci\u00f3roml\u00e1s.<\/li>\n\n\n<li>Er\u0151forr\u00e1sok elt\u00e9r\u00edt\u00e9se (a domained tekint\u00e9ly\u00e9t m\u00e1s tartalomra haszn\u00e1lj\u00e1k).<\/li>\n\n\n<li>K\u00e9sleltetett detekt\u00e1l\u00e1s, mert manu\u00e1lis b\u00f6ng\u00e9sz\u00e9sn\u00e9l nem j\u00f6n el\u0151 a payload.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Gyan\u00fas jelek: mikor kezdj el azonnal vizsg\u00e1l\u00f3dni?<\/h2>\n\n\n\n<p>Cloaking eset\u00e9n a klasszikus \u201ea site felt\u00f6rt\u201d jelek sokszor hi\u00e1nyoznak. \u00c9rdemes c\u00e9lzottan ezeket figyelni:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Rossz min\u0151s\u00e9g\u0171 vagy irrelev\u00e1ns Google tal\u00e1latok a domainre (spam jelleg\u0171 snippetek, furcsa title-ek).<\/li>\n\n\n<li>Frissen m\u00f3dos\u00edtott core f\u00e1jlok (k\u00fcl\u00f6n\u00f6sen: <code>index.php<\/code>).<\/li>\n\n\n<li>Ismeretlen, gyan\u00fas URL-ek felbukkan\u00e1sa (Search Console-ban vagy logokban).<\/li>\n\n\n<li>Szokatlan szerverlog mint\u00e1k: botokn\u00e1l m\u00e1s v\u00e1laszm\u00e9ret, elt\u00e9r\u0151 \u00fatvonalak, v\u00e1ratlan \u00e1tir\u00e1ny\u00edt\u00e1sok.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Konkr\u00e9t indik\u00e1tor a Sucuri eset\u00e9b\u0151l<\/h4>\n\n\n<p>A forr\u00e1sban szerepl\u0151 t\u00e1voli domain: <code>amp-samaresmanor[.]pages[.]dev<\/code>. A Sucuri szerint ezt az URL-t a VirusTotal 2 vendor alapj\u00e1n blokkolta a cikk \u00edr\u00e1sakor, \u00e9s t\u00f6bb (5) oldaln\u00e1l tal\u00e1ltak vele kapcsolatot.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Mit csin\u00e1l a WordPress core f\u00e1jlokkal? (wp-load.php \u00e9s wp-blog-header.php) <\/h2>\n\n\n\n<p>A t\u00e1mad\u00f3k nem v\u00e9letlen\u00fcl ny\u00falnak core f\u00e1jlokhoz: \u00edgy a saj\u00e1t k\u00f3djuk \u00fagy tud futni, hogy k\u00f6zben a WordPress norm\u00e1l m\u0171k\u00f6d\u00e9s\u00e9t is \u201emegtartj\u00e1k\u201d \u2013 vagy \u00e9pp szelekt\u00edven elind\u00edtj\u00e1k.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><code>wp-load.php<\/code>: a malware a forr\u00e1s szerint beh\u00fazza (<code>require_once __DIR__ . '\/wp-load.php'<\/code>), ezzel \u201ebootstrappel\u201d WordPress k\u00f6rnyezetet, hozz\u00e1f\u00e9r a konfigur\u00e1ci\u00f3hoz \u00e9s az adatb\u00e1zishoz.<\/li>\n\n\n<li><code>wp-blog-header.php<\/code>: a norm\u00e1l WordPress <code>index.php<\/code> v\u00e9g\u00e9n szerepl\u0151 beh\u00faz\u00e1s; a t\u00e1mad\u00f3 ezt \u00fagy alak\u00edthatja, hogy csak bizonyos esetekben jusson el id\u00e1ig a fut\u00e1s.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Takar\u00edt\u00e1s \u00e9s megel\u0151z\u00e9s: mire \u00e9rdemes f\u00f3kusz\u00e1lni?<\/h2>\n\n\n\n<p>A Sucuri javaslatai alapj\u00e1n enn\u00e9l a t\u00edpus\u00fa fert\u0151z\u00e9sn\u00e9l nem el\u00e9g \u201er\u00e1n\u00e9zni\u201d a frontend-re. A c\u00e9lzott v\u00e9dekez\u00e9shez a k\u00f6vetkez\u0151 l\u00e9p\u00e9sek kellenek:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Ismeretlen f\u00e1jlok \u00e9s k\u00f6nyvt\u00e1rak t\u00f6rl\u00e9se: ami nem a ti\u00e9d vagy a fejleszt\u0151d\u00e9, menjen karant\u00e9nba \u00e9s vizsg\u00e1ld meg.<\/li>\n\n\n<li>Felhaszn\u00e1l\u00f3k auditja: gyan\u00fas adminok, \u201eseg\u00e9d\u201d fi\u00f3kok t\u00f6rl\u00e9se.<\/li>\n\n\n<li>Minden jelsz\u00f3 cser\u00e9je: WordPress admin, FTP\/SFTP, hosting, adatb\u00e1zis, \u00e9s ahol m\u00e9g hozz\u00e1f\u00e9r\u00e9s van.<\/li>\n\n\n<li>Saj\u00e1t g\u00e9ped \u00e1tvizsg\u00e1l\u00e1sa: teljes v\u00edrusirt\u00f3\/malware scan, mert a bel\u00e9p\u00e9si adatok ellop\u00e1sa gyakori bel\u00e9p\u00e9si pont.<\/li>\n\n\n<li>Minden friss\u00edt\u00e9se: WordPress core, b\u0151v\u00edtm\u00e9nyek, sablonok \u2013 k\u00fcl\u00f6n\u00f6sen az elhagyott (abandoned) komponensek vesz\u00e9lyesek.<\/li>\n\n\n<li>WAF haszn\u00e1lata: Web Application Firewall (alkalmaz\u00e1sr\u00e9teg\u0171 t\u0171zfal), ami tudja blokkolni a gyan\u00fas forgalmat \u00e9s cs\u00f6kkentheti az els\u0151dleges felt\u00f6lt\u00e9s\/kompromitt\u00e1l\u00e1s es\u00e9ly\u00e9t.<\/li>\n\n\n<li>File Integrity Monitoring bevezet\u00e9se: f\u00e1jlintegrit\u00e1s-ellen\u0151rz\u00e9s, ami azonnal jelez, ha core f\u00e1jlok (pl. <code>index.php<\/code>) v\u00e1ltoznak.<\/li>\n\n\n<li>Google Search Console rendszeres \u00e1tn\u00e9z\u00e9se: v\u00e1ratlan URL-ek, hirtelen megugr\u00f3 indexelt oldalsz\u00e1m, ismeretlen tartalmak gyors kisz\u00far\u00e1sa.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">\u00d6sszefoglal\u00f3: a \u201ecsendes\u201d malware korszak\u00e1ban a botok a c\u00e9lpontok<\/h2>\n\n\n\n<p>Ez a t\u00e1mad\u00e1s j\u00f3 p\u00e9lda arra, merre tart a WordPress elleni malware: nem felt\u00e9tlen\u00fcl l\u00e1tv\u00e1nyos \u00e1tir\u00e1ny\u00edt\u00e1sokkal dolgozik, hanem c\u00e9lzottan a keres\u0151robotoknak \u00e9p\u00edt alternat\u00edv val\u00f3s\u00e1got. A User-Agent sz\u0171r\u00e9st IP-tartom\u00e1ny valid\u00e1l\u00e1ssal (ASN + CIDR, bitm\u0171veletek, IPv6 t\u00e1mogat\u00e1s) er\u0151s\u00edti meg, \u00edgy a fert\u0151z\u00e9s sok\u00e1ig rejtve maradhat. Ha a Google-ben furcsa tal\u00e1latok jelennek meg, az <code>index.php<\/code> \u00e9s a core f\u00e1jlok integrit\u00e1sa legyen az els\u0151 ellen\u0151rz\u00e9si pontod.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1270\" height=\"936\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees.png\" alt=\"P\u00e9lda arra, hogy a Google spam tartalmat l\u00e1t, mik\u00f6zben a l\u00e1togat\u00f3k az eredeti oldalt\" class=\"wp-image-206\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees.png 1270w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees-300x221.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees-1024x755.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees-768x566.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/2\/2026\/01\/What-Google-sees-400x295.png 400w\" sizes=\"auto, (max-width: 1270px) 100vw, 1270px\" \/><figcaption class=\"wp-element-caption\">Cloakingn\u00e1l a keres\u0151robotok \u00e9s a felhaszn\u00e1l\u00f3k elt\u00e9r\u0151 tartalmat kaphatnak ugyanarr\u00f3l az URL-r\u0151l. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n<div class=\"references-section\">\n                <h2>Hivatkoz\u00e1sok \/ Forr\u00e1sok<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/malware-intercepts-googlebot-via-ip-verified-conditional-logic.html\" target=\"_blank\" rel=\"noopener noreferrer\">Malware Intercepts Googlebot via IP-Verified Conditional Logic<\/a><\/li><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/google-sees-spam-you-see-your-site-a-cloaked-seo-spam-attack.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack<\/a><\/li><li><a href=\"https:\/\/www.virustotal.com\/gui\/url\/5a006beedf563c6215a31746d011d13fd4f2561a1bf3b557484c4532b13e1ec6?nocache=1\" target=\"_blank\" rel=\"noopener noreferrer\">VirusTotal URL report (amp-samaresmanor.pages.dev)<\/a><\/li><li><a href=\"https:\/\/publicwww.com\/websites\/amp-samaresmanor.pages\/\" target=\"_blank\" rel=\"noopener noreferrer\">publicwww: amp-samaresmanor.pages<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/website-firewall\/\" target=\"_blank\" rel=\"noopener noreferrer\">Web Application Firewall<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/malware-detection-scanning\/\" target=\"_blank\" rel=\"noopener noreferrer\">File Integrity Monitoring<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Egyre gyakoribb, hogy a t\u00e1mad\u00f3k nem a l\u00e1togat\u00f3kat, hanem a keres\u0151robotokat verik \u00e1t: a b\u00f6ng\u00e9sz\u0151ben minden rendben, k\u00f6zben a Google teljesen m\u00e1s tartalmat kap. Megn\u00e9zz\u00fck, hogyan m\u0171k\u00f6dik az IP-ellen\u0151rz\u00e9ssel megt\u00e1mogatott cloaking, \u00e9s mire figyelj WordPress-ben.<\/p>\n","protected":false},"author":5,"featured_media":198,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[91,92,89,90,88],"class_list":["post-207","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-biztonsag","tag-cloaking","tag-googlebot","tag-malware","tag-seo-spam","tag-wordpress-biztonsag"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/comments?post=207"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/207\/revisions"}],"predecessor-version":[{"id":252,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/207\/revisions\/252"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media\/198"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media?parent=207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/categories?post=207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/tags?post=207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}