site redirecting to unknown URL

Question

Recently we had an issue with our magento site. When we try to access the site using URL or using the IP it was redirecting an IP called testp1.piwo.pila.pl

The admin panel was also inaccessible. Anyone faced this issue before?

Answer 1

You should first try to recover your site.

I suggest that you check your db for secure and unsecure urls with this query:

select * from core_config_data where path like '%secure%';

And change back the urls, you should also check for changes in your code in your servers, read here: https://magento.stackexchange.com/a/101288/5913. (this will help you identify changes in Magrento Core). For your own modules use your VCS.

You can check your site to see which security patches are installed using this: https://www.magereport.com/

Once you have gained access to your system again you should check for new admin accounts, or remove all accounts and create new ones. Make sure you apply the security patches, and that you remove the files that were changed if any. Also you should check for changes in your cms blocks, cms pages, etc, check this link for that: https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html

Good luck