Here is an example of an infected Google Tag Manager with symptoms such as a WordPress site redirecting to another site (clicking a button jumps to a different site).

Malware contained in Google Tag Manager not detected by malware inspection within WordPress

Google Tag Manager is a service that allows you to add various features to your site from Google’s admin panel and embed the program in WordPress in bulk.

If there is a malware (malicious code, virus) infected file in this tag manager, it cannot be detected no matter how much you scan the files on WordPress because the file exists on Google’s servers.

If the malware cannot be detected by the malware detection plugin, we recommend that you suspect the tag manager, since this is a program that resides on Google’s system.

Malware transmitted by api.dot-metrix.com

api.dot-metrix.com was originally a service that provided access analysis and was used by many companies. However, the service was terminated last year, and the domain has been acquired by another user.

This user (hacker) has re-created a malware distribution site on the exact same address, api.dot-metrix.com, that misdirects users to an unintended page by clicking a page or a button on the site, and has been using the api.dot-metrix.com service as the site that was originally used. We have received requests for malware removal from sites that originally used the api.dot-metrix.com service and still have the tag on the site.

Prevent malware distribution by api.dot-metrix.com

If your Google Tag Manager includes services provided by the dot-metrix.com domain, please remove that part. Even if it is not in the tag manager, it may be listed directly in the database or theme header, so please inspect these as well.

(Malicious code from dot-metrix.com found directly in your site’s database or files can be detected with the [Free] WordPress: Malware Scanning & Security Plugin [Malware and Virus Detection and Removal] ).

Related Posts:

  1. WordPress Rarely, a redirect hack that sends the site to another site only from Google search results.
    This section describes a redirect hack that forces WordPress to go to a different rogue site only in rare cases (some patterns say only on smartphones) when jumping from search engine results, and explains how to deal with it....
  2. WordPress index.php malware (virus) infection case
    If you find the following code in some index.php files included in your WordPress site, you are infected with malware and should be careful....
  3. If WordPress may be infected with malware (virus or tampering), use the plugin for quick malware inspection and removal.
    When WordPress may be infected with malware (virus or tampering), you can easily use a plugin to inspect and remove malware. The following is a list of the main types of malware behavior on websites and malware scanning and disinfection plug-ins....
  4. Vulnerability in File Manager Plugin, which allows WordPress to operate like FTP software
    The File Manager plug-in, which enables file manipulation on the administration screen like FTP software and has been installed on over 700,000 sites, has a very dangerous vulnerability in version 6.9 or lower....
  5. WordPress malware, heck.php showing fake Google login screen
    Recently, many websites have been defaced to display fake Google login screens, and we will provide examples and explanations of these defacements....
  6. A case of malware embedding where WordPress sends you to another site without your permission for robot verification.
    There has been a recent increase in cases of redirect hacks where WordPress sites are redirected to another site for robot verification without permission. Here are some examples of this malware embedding and how to deal with it....