Printable View
Wow nice tracing. How do you do that? Al I can do is whois someone by there ip.
(talking to the owner of that site now) Seems to me that you got attacked by a defacer. Maybe its a try out for a group or just showing of theire skills. If nothing else happend they will quite in a while. I would let wildred do some scans and testing. I don't know much about server but maybe you can install it with a firewall if thats possible. By the way are your log files deleted?
Uh wow...Quote:
Seems to me that you got attacked by a defacer.
This guy claims to have been defaced twice.Quote:
Maybe its a try out for a group or just showing of theire skills. If nothing else happend they will quite in a while.
This person has already mentioned that they aren't the ones hosting.Quote:
I would let wildred do some scans and testing. I don't know much about server but maybe you can install it with a firewall if thats possible. By the way are your log files deleted
Here you go DakX... http://www.smartwayreading.com/
Nihil
Your "Fraudulent rDNS" records are not normally fraudulent. Sam Spade etc. reports them as that because the rDNS record is not resolved by the authoritative DNS server for the netblock. For example, internally I resolve xxx.xxx.xxx.xxx to firewall.mycompany.com yet the IP address is owned by my ISP. When I do a tracert in Sam Spade it reports that the first hop is "firewall.mycompany.com fraudulent rDNS" because the resolving server is one within my network and is not the authoritative server for the netblock. It's not fraudulaent - but it could be.... ;)
Wow, me being part turkish, am ashamed that they would stoop so low...
I don't suppose trying to find them is gonna help, even if you do, and he's in turkey, the turkish government won't likely do much...
What you should do, and they have been repeated 14 times already, is:
1 Change FTP password to a secure password... Names, birthdays, sports teams, etc, are not secure passwords...
2 Full PC scan with AV and Anti spyware/adware...
3. Contact Hosting Service and ask them to install all updates and patches!!
Good luck!
BTW, the reason your page on google is still messed up is because google's spiders have spidered the hacked content and not your fixed content... Time will fix this when google spiders your site again...
It was probably a botnet attack, and they nailed the same server twice since they didnt patch whatever exploit the first time....
Specialist: Is that GG Allen? awesome.
I did a Google search. It returned this:
http://www.google.com/search?q=%22Ha...thingforTurkey
This hacker has been pretty busy lately. And many of these sites haven't even been repaired, apparantly. I wonder if those other sites are also hosted by your webhost. If that is the case, there's nothing you can do about it because THEY are hacked, not you...
Hacking into a webhost isn't very difficult, btw. One method for a hacker would be to register for a website on that host themselves. Or they just hack into an existing webpage on that host. Once they have access to a web account, they can install certain files on this host in an attempt to gain more control over it. In the worst case, they can use their single web account to defile everything hosted on this webserver. And they will also be able to remove all traces of their actions too.
While using a webhost for your site will save you the trouble of serving the site yourself on your own computer, there is of course an additional security risk in this all. It's just a matter of attacking the weakest link. No matter how secure you make your own site, if another website on that server happens to have a very weak security then it will happen again.
Anyway, be glad that this hacker just defiled your page. They could have done something that's a lot worse...
WOW for someone who just got 0wn3d...misscoco sure replies fast....NOT:)