{"id":72,"date":"2026-01-13T00:00:00","date_gmt":"2026-01-12T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/lt\/kai-wordpress-index-php-pradeda-kalbetis-tik-su-googlebot-pazangus-cloaking-su-ip-asn-tikrinimu\/"},"modified":"2026-01-20T06:33:12","modified_gmt":"2026-01-20T05:33:12","slug":"kai-wordpress-index-php-pradeda-kalbetis-tik-su-googlebot-pazangus-cloaking-su-ip-asn-tikrinimu","status":"publish","type":"post","link":"https:\/\/helloblog.io\/lt\/kai-wordpress-index-php-pradeda-kalbetis-tik-su-googlebot-pazangus-cloaking-su-ip-asn-tikrinimu\/","title":{"rendered":"Kai WordPress index.php pradeda \u201ekalb\u0117tis\u201c tik su Googlebot: pa\u017eangus cloaking su IP (ASN) tikrinimu"},"content":{"rendered":"\n<p>Pastaruoju metu vis da\u017eniau matyti ne triuk\u0161mingi \u201eperadresuok visus \u012f spam\u0105\u201c scenarijai, o gerokai subtilesn\u0117s infekcijos. Id\u0117ja paprasta: svetain\u0117s savininkas ir real\u016bs lankytojai mato \u012fprast\u0105 turin\u012f, o paie\u0161kos sistem\u0173 robotams pateikiamas kitas \u2013 da\u017eniausiai spam, doorway ar \u201eaffiliate\u201c turinys. Tokia taktika leid\u017eia i\u0161naudoti svetain\u0117s reputacij\u0105 SEO tikslams ir ilgiau i\u0161likti nepasteb\u0117tai.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kas buvo aptikta: selektyvi turinio injekcija WordPress index.php<\/h2>\n\n\n\n<p>Analizuojant vien\u0105 u\u017ekr\u0117st\u0105 WordPress svetain\u0119, kenk\u0117ji\u0161kas kodas buvo rastas pagrindiniame <code>index.php<\/code>. Vietoje \u012fprasto WordPress \u201ebootstrap\u201c (\u012fk\u0117limo) srauto \u0161is failas elg\u0117si kaip vartininkas: pirmiausia nustatydavo, kas at\u0117jo \u012f svetain\u0119, o tada priimdavo sprendim\u0105 \u2013 rodyti \u0161var\u0173 puslap\u012f ar \u012fterpti nuotolin\u012f turin\u012f.<\/p>\n\n\n\n<p>Svarbiausia detal\u0117: tai ne vien User-Agent filtravimas. \u0160\u012f kart\u0105 buvo naudojamas IP tikrinimas pagal Google priklausan\u010dius tinklus \u2013 ir dar su tikra tinkl\u0173 matematika, o ne paprastu \u201estring match\u201c.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1360\" height=\"636\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic.png\" alt=\"Schema: IP patikrintas s\u0105lyginis turinio pateikimas (\u012fprasti lankytojai vs Googlebot)\" class=\"wp-image-64\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic.png 1360w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic-1024x479.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic-768x359.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/IP-Verified-Conditional-Logic-400x187.png 400w\" sizes=\"auto, (max-width: 1360px) 100vw, 1360px\" \/><figcaption class=\"wp-element-caption\">Kenk\u0117ji\u0161kas \u201evartininkas\u201c sprend\u017eia, kam rodyti nuotolin\u012f payload\u2019\u0105. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Kuo \u0161is atvejis i\u0161siskiria: Google ASN diapazonai ir CIDR + bitin\u0117s operacijos<\/h2>\n\n\n\n<p>Dauguma \u201ecloaking\u201c (turinio maskavimo) skript\u0173 apsiriboja <code>User-Agent<\/code> eilute: jei joje yra \u201eGooglebot\u201c \u2013 rodome vien\u0105, jei ne \u2013 kit\u0105. Problema ta, kad <code>User-Agent<\/code> lengva suklastoti. Tod\u0117l \u0161i infekcija \u0117jo toliau: ji tur\u0117jo \u201ehardcodint\u0105\u201c (\u012fra\u0161yt\u0105 tiesiai \u012f kod\u0105) didel\u012f Google ASN IP diapazon\u0173 s\u0105ra\u0161\u0105 CIDR formatu ir tikrino, ar u\u017eklausa tikrai at\u0117jo i\u0161 Google infrastrukt\u016bros.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Kas yra ASN (Autonomous System Number) \u0161iame kontekste?<\/h3>\n\n\n\n<p>ASN (Autonomous System Number) \u2013 tai autonomin\u0117s sistemos numeris, savoti\u0161kas organizacijos \u201einterneto identitetas\u201c. Praktikoje tai rei\u0161kia IP adres\u0173 blokus, kurie priklauso ir yra valdomi, pvz., Google (Gmail, Search, Google Cloud ir pan.). Jei u\u017eklausa ateina i\u0161 Google ASN priklausan\u010dio IP, tikimyb\u0117, kad tai \u201etikras\u201c Google crawler\u2019is, yra nepalyginamai didesn\u0117 nei vien pasitikint <code>User-Agent<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Kas yra CIDR formatas?<\/h3>\n\n\n\n<p>CIDR (Classless Inter-Domain Routing) \u2013 kompakti\u0161kas b\u016bdas apra\u0161yti IP blok\u0105, pvz. <code>192.168.1.0\/24<\/code>. Vietoje to, kad vardintume kiekvien\u0105 adres\u0105, nurodome tinklo prad\u017ei\u0105 ir prefikso ilg\u012f (<code>\/24<\/code>), kuris apibr\u0117\u017eia, kiek adres\u0173 patenka \u012f t\u0105 blok\u0105.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1332\" height=\"620\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format.png\" alt=\"CIDR formato pavyzdys su prefikso ilgiu \/24\" class=\"wp-image-65\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format.png 1332w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format-1024x477.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format-768x357.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/CIDR-format-400x186.png 400w\" sizes=\"auto, (max-width: 1332px) 100vw, 1332px\" \/><figcaption class=\"wp-element-caption\">CIDR leid\u017eia apra\u0161yti IP blok\u0105 vienu \u012fra\u0161u. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<p>Praktin\u0117 \u0161io sprendimo nauda u\u017epuolikui: jis gali rodyti kenk\u0117ji\u0161k\u0105 turin\u012f tik realiems Google servisams, o bet kokiam \u201erankiniam tikrinimui\u201c (nar\u0161ykl\u0117je, per paprast\u0105 curl, per daugum\u0105 monitoring\u2019\u0173) \u2013 \u0161vari\u0105 svetain\u0119. Dar viena detal\u0117 \u2013 skriptas tur\u0117jo solid\u0173 IPv6 palaikym\u0105, kurio senesni cloaking pavyzd\u017eiai da\u017enai neturi.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 tai daro tavo svetainei: ne tiek \u201ehack\u201c, kiek SEO reputacijos sabota\u017eas<\/h2>\n\n\n\n<p>Tokios infekcijos tikslas da\u017eniausiai n\u0117ra tiesiogiai u\u017ekr\u0117sti lankytoj\u0173 \u012frenginius. Pagrindinis sm\u016bgis \u2013 paie\u0161kos rezultatams ir domeno reputacijai, nes Google indeksuoja turin\u012f, kurio real\u016bs \u017emon\u0117s nemato.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Deindeksavimas arba dalinis i\u0161metimas i\u0161 paie\u0161kos (kai Google pamato spam \/ doorway turin\u012f).<\/li>\n\n\n<li>Blacklisting \/ reputacijos signalai, kurie v\u0117liau atsiliepia visam projektui.<\/li>\n\n\n<li>Resurs\u0173 \u201ehijacking\u201c \u2013 svetain\u0117s autoritetas naudojamas svetimam turiniui kelti.<\/li>\n\n\n<li>V\u0117luojantis aptikimas: savininkas nar\u0161o ir nemato problemos, tod\u0117l incidentas t\u0119siasi ilgiau.<\/li>\n\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1270\" height=\"936\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees.png\" alt=\"Pavyzdys: k\u0105 Google mato u\u017ekr\u0117stoje svetain\u0117je, kai lankytojas mato normal\u0173 puslap\u012f\" class=\"wp-image-66\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees.png 1270w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees-300x221.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees-1024x755.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees-768x566.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/What-Google-sees-400x295.png 400w\" sizes=\"auto, (max-width: 1270px) 100vw, 1270px\" \/><figcaption class=\"wp-element-caption\">Cloaking esm\u0117 \u2013 skirtingas turinys botams ir \u017emon\u0117ms. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Tipiniai po\u017eymiai, kad tai vyksta (net jei frontas atrodo \u201e\u0161varus\u201c)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Keisti arba prasti Google rezultatai (netik\u0117ti title\/description, \u201espammy\u201c raktiniai \u017eod\u017eiai, nepa\u017e\u012fstami URL).<\/li>\n\n\n<li>Neseniai modifikuoti core failai (ypa\u010d <code>index.php<\/code>).<\/li>\n\n\n<li>\u012etartini i\u0161oriniai URL ar domenai, kurie atsiranda kode arba loguose.<\/li>\n\n\n<li>Netik\u0117ti \u012fra\u0161ai serverio loguose, ypa\u010d susij\u0119 su crawl\u2019eriais ir redirect\u2019ais.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Svarbi detal\u0117<\/h4>\n\n\n<p>\u0160i kampanija naudojo nuotolin\u012f \u0161altin\u012f <code>hxxps:\/\/amp-samaresmanor[.]pages[.]dev<\/code> (apra\u0161yme min\u0117ta, kad domenas tuo metu buvo aptiktas VirusTotal ir siejamas su infekuotomis svetain\u0117mis). Jei toki\u0105 nuorod\u0105 pamatai kode ar loguose \u2013 tai rimtas indikatorius, kad vyksta selektyvus turinio tiekimas.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kaip veikia \u201evartininkas\u201c index.php faile: 5 sluoksni\u0173 logika<\/h2>\n\n\n\n<p>U\u017ekr\u0117stas <code>index.php<\/code> \u012fgyvendina s\u0105lygin\u0119 logik\u0105, kuri\u0105 patogu m\u0105styti kaip kelis patikros sluoksnius.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Daugiasluoksn\u0117 identiteto patikra (User-Agent + IP)<\/h3>\n\n\n\n<p>Pirmiausia tikrinamas <code>HTTP_USER_AGENT<\/code> (nar\u0161ykl\u0117s\/kliento identifikatorius, siun\u010diamas su kiekviena HTTP u\u017eklausa). Kadangi j\u012f suklastoti paprasta, po to vyksta IP validacija pagal Google tinkl\u0173 diapazonus.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"498\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification.png\" alt=\"Schema: User-Agent patikra ir IP validacija kaip papildomas sluoksnis\" class=\"wp-image-67\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification.png 1880w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification-300x79.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification-1024x271.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification-768x203.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification-1536x407.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Multi-Layer-Identity-Verification-400x106.png 400w\" sizes=\"auto, (max-width: 1880px) 100vw, 1880px\" \/><figcaption class=\"wp-element-caption\">Vien User-Agent nepakanka \u2013 pridedamas IP patikrinimas. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2) IP tikrinimas bitin\u0117mis operacijomis (bitwise)<\/h3>\n\n\n\n<p>\u010cia ir prasideda \u201erimtesn\u0117\u201c dalis: vietoje paprasto palyginimo, ar IP patenka \u012f diapazon\u0105, naudojamos bitin\u0117s operacijos su netmask\u2019u. IPv4 logika i\u0161 esm\u0117s remiasi tokia lygybe (pateikiama kaip principas):<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Principas: IP priklausomyb\u0117 tinklui tikrinama per bitwise AND su netmask\n\/\/ (konkretus kenk\u0117ji\u0161ko kodo \u012fgyvendinimas gali skirtis)\nif ( ($ip_decimal &amp; $netmask_decimal) == ($range_decimal &amp; $netmask_decimal) ) {\n    \/\/ IP patenka \u012f CIDR blok\u0105\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Principas: IP priklausomyb\u0117 tinklui tikrinama per bitwise AND su netmask<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ (konkretus kenk\u0117ji\u0161ko kodo \u012fgyvendinimas gali skirtis)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">if<\/span><span style=\"color:#E1E4E8\"> ( ($ip_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal) <\/span><span style=\"color:#F97583\">==<\/span><span style=\"color:#E1E4E8\"> ($range_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ IP patenka \u012f CIDR blok\u0105<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1420\" height=\"734\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation.png\" alt=\"Bitwise IP diapazono validacijos schema\" class=\"wp-image-68\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation.png 1420w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation-300x155.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation-1024x529.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation-768x397.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Bitwise-IP-Range-Validation-400x207.png 400w\" sizes=\"auto, (max-width: 1420px) 100vw, 1420px\" \/><figcaption class=\"wp-element-caption\">Matematinis patikrinimas apsunkina \u201egreit\u0105\u201c aptikim\u0105 ir klaidingus teigiamus atvejus. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">3) Nuotolinio payload\u2019o atsiuntimas per cURL<\/h3>\n\n\n\n<p>Kai lankytojas patvirtinamas kaip \u201elegit\u201c botas, skriptas per cURL atsisiun\u010dia turin\u012f i\u0161 i\u0161orinio URL ir j\u012f tiesiogiai atspausdina atsakyme. Paie\u0161kos robotui atrodo, kad turinys yra svetain\u0117s dalis.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Id\u0117ja: patvirtintam botui fetch\u2019inamas nuotolinis turinys\n\/\/ \u0160altinis tyrime: hxxps:\/\/amp-samaresmanor[.]pages[.]dev\n\/\/ ir turinys gr\u0105\u017einamas tiesiai kaip puslapio HTML.\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Id\u0117ja: patvirtintam botui fetch\u2019inamas nuotolinis turinys<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ \u0160altinis tyrime: hxxps:\/\/amp-samaresmanor[.]pages[.]dev<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ ir turinys gr\u0105\u017einamas tiesiai kaip puslapio HTML.<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1444\" height=\"836\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL.png\" alt=\"Schema: cURL u\u017eklausa \u012f nuotolin\u012f pages.dev \u0161altin\u012f ir turinio injekcija\" class=\"wp-image-69\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL.png 1444w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL-300x174.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL-1024x593.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL-768x445.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Remote-Payload-Execution-via-cURL-400x232.png 400w\" sizes=\"auto, (max-width: 1444px) 100vw, 1444px\" \/><figcaption class=\"wp-element-caption\">Nuotolinis turinys pateikiamas taip, lyg b\u016bt\u0173 generuotas svetain\u0117je. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">4) Platus User-Agent s\u0105ra\u0161as (ne tik \u201eGooglebot\u201c)<\/h3>\n\n\n\n<p>Filtravimas ap\u0117m\u0117 ne vien \u201eGooglebot\u201c. \u012etraukiami ir kiti Google \u012frankiai: svetain\u0117s verifikavimo, inspekcijos, API crawler\u2019iai \u2013 kad pasl\u0117ptas turinys b\u016bt\u0173 matomas kuo daugiau Google ekosistemos komponent\u0173.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1682\" height=\"554\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering.png\" alt=\"User-Agent filtravimo schema su keliomis Google paslaugomis\" class=\"wp-image-70\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering.png 1682w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering-300x99.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering-1024x337.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering-768x253.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering-1536x506.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/User-Agent-Filtering-400x132.png 400w\" sizes=\"auto, (max-width: 1682px) 100vw, 1682px\" \/><figcaption class=\"wp-element-caption\">Platesnis filtravimas didina tikimyb\u0119, kad spam turinys bus nuskaitytas ir patvirtintas. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">5) Sprendim\u0173 logika + klaid\u0173 logavimas<\/h3>\n\n\n\n<p>Galutinis modulis sujungia dvi patikras (User-Agent ir IP) ir elgiasi skirtingai priklausomai nuo rezultato. Buvo matyti ir klaid\u0173 apdorojimas bei logavimas \u2013 tai leid\u017eia u\u017epuolikui steb\u0117ti, ar schema veikia.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Jei botas \u201etikras\u201c: pateikiamas nuotolinis turinys; jei nepavyksta jo u\u017ekrauti, botas nukreipiamas \u012f <code>\/home\/<\/code>, kad Google nematyt\u0173 \u201ebroken\u201c puslapio.<\/li>\n\n\n<li>Jei botas \u201enetikras\u201c (User-Agent suklastotas, bet IP nepraeina): fiksuojama klaida (\u201eFake GoogleBot detected\u201c) ir nukreipiama \u012f normal\u0173 puslap\u012f.<\/li>\n\n\n<li>Jei paprastas lankytojas: i\u0161kart rodomas \u012fprastas turinys (arba redirect \u012f \u012fprast\u0105 home).<\/li>\n\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1694\" height=\"680\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging.png\" alt=\"S\u0105lygin\u0117s logikos ir error logging schema: tikras botas vs netikras botas vs paprastas lankytojas\" class=\"wp-image-71\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging.png 1694w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging-300x120.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging-1024x411.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging-768x308.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging-1536x617.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/20\/2026\/01\/Conditional-Logic-and-Error-Logging-400x161.png 400w\" sizes=\"auto, (max-width: 1694px) 100vw, 1694px\" \/><figcaption class=\"wp-element-caption\">\u201eTylus\u201c cloaking su ai\u0161kiais keliais kiekvienam lankytojui. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Kod\u0117l b\u016btent WordPress core failai yra patogus taikinys<\/h2>\n\n\n\n<p>Tokio tipo injekcija <code>index.php<\/code> faile ypa\u010d efektyvi, nes tai vienas pirm\u0173j\u0173 vykdom\u0173 ta\u0161k\u0173. Be to, kenk\u0117ji\u0161kas kodas gali \u201eu\u017esikabinti\u201c u\u017e WordPress \u012fk\u0117limo mechanizmo, pasikviesdamas core failus.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><code>wp-load.php<\/code>: kvietimas per <code>require_once __DIR__ . '\/wp-load.php'<\/code> u\u017ekrauna WordPress aplink\u0105 (konfig\u016bracij\u0105, DB prisijungim\u0105 ir pan.), tod\u0117l skriptas gali veikti \u201esu visais patogumais\u201c.<\/li>\n\n\n<li><code>wp-blog-header.php<\/code>: tipinis <code>index.php<\/code> pabaigoje naudojamas failas, kuris u\u017ebaigia \u012fprast\u0105 WordPress puslapio generavim\u0105. Tai leid\u017eia kenk\u0117jui i\u0161laikyti normal\u0173 svetain\u0117s veikim\u0105 \u017emon\u0117ms.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 daryti incidento metu: praktiniai \u017eingsniai (be magijos)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Izoliuok pakeitimus: patikrink, ar core failai (ypa\u010d <code>index.php<\/code>) nebuvo modifikuoti. Jei turi deployment\u2019\u0105 per Git \u2013 palyginimas labai greitas.<\/li>\n\n\n<li>Pa\u0161alink nepa\u017e\u012fstamus failus ir katalogus: viskas, ko ne\u012fdieg\u0117te j\u016bs ar komanda, yra \u012ftartina, ypa\u010d jei atsirado neseniai.<\/li>\n\n\n<li>Per\u017ei\u016br\u0117k vartotojus WordPress\u2019e: pa\u0161alink \u201epagalbos\u201c paskyras ir \u012ftartinus administratorius.<\/li>\n\n\n<li>Atnaujink kredencialus: WP admin, FTP\/SFTP, hosting, DB slapta\u017eod\u017eius (ir, jei aktualu, raktus).<\/li>\n\n\n<li>Patikrink savo kompiuter\u012f: pilnas antivirus\/malware scan \u2013 da\u017ena prie\u017eastis yra nutek\u0117j\u0119 prisijungimai.<\/li>\n\n\n<li>Atnaujink visk\u0105: WordPress core, temas, plugin\u2019us; ypa\u010d svarbu atsikratyti sen\u0173 ar apleist\u0173 komponent\u0173.<\/li>\n\n\n<li>Apsvarstyk WAF (Web Application Firewall): WAF gali pad\u0117ti blokuoti komunikacij\u0105 su \u017einomais C2\/payload \u0161altiniais ir suma\u017einti pakartotinio \u012fk\u0117limo rizik\u0105.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Prevencija, kuri realiai suveikia<\/h4>\n\n\n<p>File Integrity Monitoring (fail\u0173 vientisumo steb\u0117jimas) yra vienas i\u0161 geriausi\u0173 b\u016bd\u0173 pagauti tokias infekcijas anksti, nes jos remiasi tyliu core fail\u0173 modifikavimu. Kartu verta reguliariai per\u017ei\u016br\u0117ti Google Search Console \u2013 netik\u0117ti indeksuoti URL da\u017enai yra pirmas signalas.<\/p>\n\n<\/div>\n\n\n<div class=\"references-section\">\n                <h2>Nuorodos \/ \u0160altiniai<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/malware-intercepts-googlebot-via-ip-verified-conditional-logic.html\" target=\"_blank\" rel=\"noopener noreferrer\">Malware Intercepts Googlebot via IP-Verified Conditional Logic<\/a><\/li><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/google-sees-spam-you-see-your-site-a-cloaked-seo-spam-attack.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/website-firewall\/\" target=\"_blank\" rel=\"noopener noreferrer\">Web Application Firewall<\/a><\/li><li><a href=\"https:\/\/sucuri.net\/malware-detection-scanning\/\" target=\"_blank\" rel=\"noopener noreferrer\">File Integrity Monitoring<\/a><\/li><li><a href=\"https:\/\/www.virustotal.com\/gui\/url\/5a006beedf563c6215a31746d011d13fd4f2561a1bf3b557484c4532b13e1ec6?nocache=1\" target=\"_blank\" rel=\"noopener noreferrer\">VirusTotal URL report<\/a><\/li><li><a href=\"https:\/\/publicwww.com\/websites\/amp-samaresmanor.pages\/\" target=\"_blank\" rel=\"noopener noreferrer\">publicwww results for amp-samaresmanor.pages<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Klasikiniai redirect\u2019ai darosi per lengvai pagaunami, tod\u0117l kenk\u0117jai pereina prie selektyvaus turinio tiekimo: \u017emon\u0117ms rodo tvarking\u0105 svetain\u0119, o Google infrastrukt\u016brai \u2013 visi\u0161kai kit\u0105 puslap\u012f.<\/p>\n","protected":false},"author":55,"featured_media":63,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[57,58,55,56,10],"class_list":["post-72","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-saugumas","tag-googlebot","tag-incident-response","tag-malware","tag-seo-cloaking","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/comments?post=72"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/72\/revisions"}],"predecessor-version":[{"id":118,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/72\/revisions\/118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media\/63"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media?parent=72"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/categories?post=72"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/tags?post=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}