I think my site was hacked...

[Radon3k]

Current Politics (http://www.currentpolitics.com) was defaced. I didn't do this and anybody who's even at least visited the site knows that it's a dark background with news that I had been posting. I'm wondering if this was part of the "6,000 web sites in 6 hours" hacking deal, although I didn't think I'd be such a huge target because the site is so small. It's not a dedicated server so I'm not sure what I could have done to protect the site further. I'm not really all that pissed off, kind of funny in a way, but it is still annoying.

[tgillespie]

You are the chosen one :eek:

[Cary]

FYI: Your site is mentioned at http://www.webhostingtalk.com/showthread.php?s=&threadid=161732 - there is some interesting reading over there.

[Radon3k]

Thanks for that, Cary. :) This is pretty annoying. I still haven't received a reply from my host yet and it's been a few hours. So much for "24/7 Support". :rolleyes:

[CeleronXT]

Damn... Bizarre choice. o_O

My site's still up. Running CPanel too! :eek:

[TheForumHost.com]

Current Politics (http://www.currentpolitics.com) was defaced. I didn't do this and anybody who's even at least visited the site knows that it's a dark background with news that I had been posting. I'm wondering if this was part of the "6,000 web sites in 6 hours" hacking deal, although I didn't think I'd be such a huge target because the site is so small. It's not a dedicated server so I'm not sure what I could have done to protect the site further. I'm not really all that pissed off, kind of funny in a way, but it is still annoying.

No the contest starts in a little more then an hour from now.

[Chris Stewart]

No the contest starts in a little more then an hour from now.

Where did you see that from?

[CeleronXT]

http://www.defacers-challenge.com/ ?

Maybe they started early?

[Chris Stewart]

http://www.defacers-challenge.com/ ?

Maybe they started early?

I'm setting up a webserver now to see if I can get hacked. :D

[CeleronXT]

I'm setting up a webserver now to see if I can get hacked. :D Some of us really have no lives eh? ;) (I'm no better)

[Chris Stewart]

Some of us really have no lives eh? ;) (I'm no better)

It's 1:30 am and I'm not working on a programming assignment, so no. :D

[TheForumHost.com]

Where did you see that from?


The website for this contest.... http://www.defacers-challenge.com posted the following today... "" The hours was defined will be 09:00am until 15:00pm, (have many countries involved in this contest because this the TIMEZONE will be from zone-h.org website located at Estonia) everybody groups, individuals and partipants, that have defacements notified in zone-h in that period will be automatically joined (repeat to not have doubts :-) ) ""

http://www.timeanddate.com/worldclock/city.html?n=242 shows the time it is in Estonia.

[nuno]

Current Politics (http://www.currentpolitics.com) was defaced. I think my site was hacked...
No, you were not hacked, that's not how they work, you're just fooling around.

[CeleronXT]

Then why do multiple other sites have the same "defacement"? Group plan?

CurrentPolitics.com Forum is still up.

[Chris Stewart]

Then why do multiple other sites have the same "defacement"? Group plan?

Links?

[CeleronXT]

http://squarehq.net/

From the WHT link.

[Chris Stewart]

Apache setup and configured. Come on hackers!

[okrogius]

Current Politics (http://www.currentpolitics.com) was defaced. I didn't do this and anybody who's even at least visited the site knows that it's a dark background with news that I had been posting. I'm wondering if this was part of the "6,000 web sites in 6 hours" hacking deal, although I didn't think I'd be such a huge target because the site is so small. It's not a dedicated server so I'm not sure what I could have done to protect the site further. I'm not really all that pissed off, kind of funny in a way, but it is still annoying.
Might be a time to look for a better host and now do your homework well.

[tgillespie]

cpanel gets owned. Glad I didnt switch to it just yet :)

[TheForumHost.com]

update from the site...

"" hello again brothers, I had to made a little change in rules because website that will use to notify the defacements its under a ddos attack.
Now, the challenge will be until 00:00 hours, finish in 7 july, to be possible all defacers notify yours defacements.
i hope www.zone-h.org website back soon cuz...
THE CHALLENGE IS STARTED! ""

[Cary]

No, you were not hacked, that's not how they work, you're just fooling around.
Actually I've seen more than 10 sites with the same page... I don't think he's "fooling around."

[Chris Stewart]

Actually I've seen more than 10 sites with the same page... I don't think he's "fooling around."

Links? I'm trying to keep track.

[Michael2]

Links? I'm trying to keep track.
You're really just trying to win aren't you? :p

So you have to register and all you get is free web hosting? That seems odd. If our government were smart they'd be the ones behind this thing.

What is cpanel anyway? I don't know if I have it. :confused:

[Erwin]

Cpanel is a control panel for server management.

[okrogius]

From what I've seen all the sites with this page seem to be using 6.0 cpanels. Another reason to switch hosts - cpanel 7 is already long out.

[phill2003]

No, you were not hacked, that's not how they work, you're just fooling around.

what about the rest of the sites that have been done over then? are they messing about too..

there's a thread over at webhosting talk with lots of url's of hacked site's in it and a convo between a host and another dood where the dood is hacking places as they speak.

its unreal, do they damage the sites as well or just put another index page up?

[Chris M]

I would imagine they overwrite / upload an index.html file...

Satan

[Radon3k]

As far as I can tell they have done no damange, they just over-wrote my index.php file and replaced it with their own.

[Kathy]

As far as I can tell they have done no damange, they just over-wrote my index.php file and replaced it with their own.

Now when I visit your site I get an error page:

The requested URL /suspended.page/ was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

The url even changes as the domain is forwarding? what's up with that?

[Radon3k]

I get something like that as well. I'm waiting on an answer from the host.

[orca]

From what I've seen all the sites with this page seem to be using 6.0 cpanels. Another reason to switch hosts - cpanel 7 is already long out.
Well, 7.0 was EDGE till Friday. I personnally rarely use EDGE versions as they can be not that stable (WHM crashed once for me). So, if they didn't upgrade this Friday...

[nuno]

Actually I've seen more than 10 sites with the same page... I don't think he's "fooling around."

Cary, any links?

Maybe I'm just missing something obvious, but can anyone tell me which group hacked these sites?

This is how they work,
Alldas.org mirror -> http://safemode.org/mirror/2002/01/24/

Like I said, this smells fishy to me...

[Zecherieh]

I have been fighing off idiot hackers for three days. Figure its going to continue all day today. I have so far blocked ten distinct IPs and tawain :)

[Cary]

Cary, any links?

Maybe I'm just missing something obvious, but can anyone tell me which group hacked these sites?

This is how they work,
Alldas.org mirror -> http://safemode.org/mirror/2002/01/24/

Like I said, this smells fishy to me...
There are some links in the WebHostingTalk link I posted earlier. I'd have to go through my history to find the rest, though.

[Radon3k]

Just an update. My host took my site offline to determine how it was hacked. They blamed it on me, saying it was my fault that my scripts weren't secure. They told me it was because of PHPNuke (which I don't even use) and vBulletin. They said that their servers were completely secure but also said that the attacker got in via cPanel. My site was offline most of the day and everytime I got into a live chat (via PHPLive) with one of the techs they kept saying, "brb" and kept insisiting that it was my fault that my site got hacked. They also said they didn't want to put my site back up until they figured out how it was hacked (yet they said previously it was through cPanel and it was my fault). This really annoys me...:rolleyes:

[Kings]

Your site seems to be back up now though...

[Radon3k]

Because I told them to put it back up.

[okrogius]

Just an update. My host took my site offline to determine how it was hacked. They blamed it on me, saying it was my fault that my scripts weren't secure. They told me it was because of PHPNuke (which I don't even use) and vBulletin. They said that their servers were completely secure but also said that the attacker got in via cPanel. My site was offline most of the day and everytime I got into a live chat (via PHPLive) with one of the techs they kept saying, "brb" and kept insisiting that it was my fault that my site got hacked. They also said they didn't want to put my site back up until they figured out how it was hacked (yet they said previously it was through cPanel and it was my fault). This really annoys me...:rolleyes:
Try asking how the rest of the sites on the same server got hacked too (check IPs on domains).

As I said before, I would *highly* suggest looking for a better host.

[Radon3k]

Apparently I was the only one on their servers. The problem is I just moved to this host and my contract isn't even up until around the first of August or so and I'm getting very tired of moving.

[okrogius]

Really? I could've sworn that another website having that exact same penguin image and being in the same IP block... Maybe its just my memory...

As far as moving, my prime suggestion for you is to pick a good host by doing homework well. Then you don't have to move as often. Send several sales emails at random times of the day (at night and day) and see how long it takes to get a responce that's helpful - random example of things you could do.

[Steve Machol]

They blamed it on me, saying it was my fault that my scripts weren't secure. They told me it was because of PHPNuke (which I don't even use) and vBulletin. They said that their servers were completely secure but also said that the attacker got in via cPanel. How can it be PHPNuke and vB one minute, then CPanel the next? It sound like they really don't have a clue.

[Radon3k]

How can it be PHPNuke and vB one minute, then CPanel the next? It sound like they really don't have a clue.
That's what I was thinking. I told them it wasn't PHPNuke because I don't have it installed and I knew it couldn't have been vBulletin and that from the WHT thread (which I gave him the link to, the same link that Cary gave me) that it was probably cPanel 6. But nope, it's my fault. :rolleyes:

[Pingu]

At least I would let them know you don't agree. Point them to the WHT thread and throw their own confused remarks back at them.

Maybe you are tired of moving, but stand up for yourself. If you're gonna take crap now, what's waiting next? Common, you want a good place for your site, and if they're messing with you, how can you be sure that's what you'll get?