1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hacked by Eno7

Discussion in 'Server Configuration and Hosting' started by Market1234, May 21, 2015.

  1. Market1234

    Market1234 Member

    my site or hosting got hacked, who can help me restore and transfer hosting??
    Clubcensus.com [[adult forum]]
     
  2. rafass

    rafass Well-Known Member

    This website is temporarily unavailable, please try again later.
     
  3. The Forum Heroes

    The Forum Heroes Well-Known Member

    Your name servers are using velocityio.com Did you contact DarkWizard and see if he found out how you were hacked in the server logs? You would first want to find that out, then restore from a backup before the hackers entry date and then fix the exploit either server wide or on the add-on that they entered though.
     
    RoldanLT likes this.
  4. Tracy Perry

    Tracy Perry Well-Known Member

    Delete the index.html that is in existence in your root. And are you using WordPress on that site anywhere? /index.php still serves up your site. The web server is set to serve index.html before it does index.php.

    The method of intrusion still needs to be found. Change your passwords to your cPanel to complex password also.
     
  5. borbole

    borbole Well-Known Member

    I get a 404 error when I load your forum. Regarding the hack, ask your host to check their access logs around the time of the hack and see what happened. I would also recommend to do a thorough checkup of your server space as well for any backdoors and such.
     
  6. The Dark Wizard

    The Dark Wizard Well-Known Member

    Already done all of this, there were no breaches or backdoors on their server. The only thing that changed was that one index file by an IP that used the password to log in.

    We've already restored it and even backed up the site completely just to be safe.

    The site is currently back and I've had her change all her passwords.
     
  7. DaveAllen

    DaveAllen Member

    Just an FYI: I just tried accessing the site and also got the lone page with: "This website is temporarily unavailable, please try again later."
     
  8. The Dark Wizard

    The Dark Wizard Well-Known Member

    That index page was cached by people's browsers most likely. Refresh a couple of times or clear your cache.

    I already see the normal site

    [​IMG]
     
  9. The Forum Heroes

    The Forum Heroes Well-Known Member

    Same, even a hard clearing of cache now shows the message rather then the hacked xenforo node list that it did last night.
     
  10. DaveAllen

    DaveAllen Member

    Well, I have never been to that site so nothing to do with any cache. However, I cleared my browsers (tried it one two different browsers) and still get the same error message.

    Also tried it just now using my phone and same result.
     
    The Forum Heroes likes this.
  11. Alex - A2Hosting

    Alex - A2Hosting Active Member

    It wouldn't be the browsers cache, most people here would be visiting this site for the first time (including myself) and are presented with the error (I get the error also).
     
    The Forum Heroes likes this.
  12. The Forum Heroes

    The Forum Heroes Well-Known Member

    Same, just tried from my iPhone and still get the error page.
     
  13. The Dark Wizard

    The Dark Wizard Well-Known Member

    Just to clarify, what error are you getting?
     
  14. The Forum Heroes

    The Forum Heroes Well-Known Member

    As already stated by several in the thread..

    white page with "This website is temporarily unavailable, please try again later."

    Trying just the domain or trying with /index.php result in the same. So it isn't just an issue of a index.html file loading before index.php as index.php gives the same error
     
  15. Alex - A2Hosting

    Alex - A2Hosting Active Member

    The same one you should be seeing: This website is temporarily unavailable, please try again later.
     
    The Forum Heroes likes this.
  16. The Dark Wizard

    The Dark Wizard Well-Known Member

    I found the problem, the dns is pointing to a completely different place.

    The webpage you are seeing isn't located on on any of our servers.
     
  17. Tracy Perry

    Tracy Perry Well-Known Member

    It's resolving now for me instead of the other error.. This is what is being sent
    Code:
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
       "http://www.w3.org/TR/html4/strict.dtd">
    <html>
    
    This website is temporarily unavailable, please try again later.
    
    
    <!-- pageok -->
    <!-- 01 -->
    <!-- -->
    </html>
    The IP for that domain (from a ping> is coming back as 50.63.202.12
     
  18. Biker

    Biker Well-Known Member

    If the affected machine has been nailed with a rootkit or some other type of malware, changing passwords isn't going to do anything but send the new passwords to those who got in the first time. Machine needs to be declared malware free before new passwords are issued/changed.
     
    The Forum Heroes and DaveAllen like this.
  19. DaveAllen

    DaveAllen Member

    @Biker is right. I have seen this happen and people change passwords over and over with the same result happening again.
     
  20. The Forum Heroes

    The Forum Heroes Well-Known Member

    DNS dig is bringing back 173.44.37.41 for Market's site DNS dig for VIO is 173.44.37.53 so it appears your site and hers are still on the same server.

    Maybe, you have a cache issue since your seeing her working site and your not routing to your server, while rest of us are seeing the error.

    Since the site was hacked on the same server you host your WHMCS on.. Have you sent out a notice to all your clients regarding a client defacement occured on the server that houses your billing system and even though no signs of further intrusion can be found at this time, we recommend you update your password for your protection.
     

Share This Page