I've found a piece of code that contacts a really weird domain with CC info.
Can someone confirm it doing something malicious?
If so, what should I do without taking down the server? I'm a total noob with 1.9.
I have root access to the old server.
- its running Ubuntu 14.04.5 LTS
- apache 2
- magento 1.9
- cache is disabled on it.
- serious perfomance issues
- running multiple sites
- I can't afford to take it down
URL location of JS injection: base_url/checkout/cart
Contacts this domain with ajax query: jqueryexts.us/gate.php
Story: I've been contracted to work on their MG2 upgrade, which hopefully will be done in 2 weeks.. was looking at the live site checkout js and found this shocker.