Wordpress compromises: What's beyond the URL?

The report describes attackers embedding reverse-proxy files into compromised WordPress sites that forward requests to obfuscated backend servers; this lets attackers control what content each visitor sees and segment traffic using parameters such as ip, dom, ref, prox, agent, and lang, enabling multiple simultaneous campaigns without redirecting users.