The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
5 views

Preventing SQL attacks [on hold]

I monitor the domlogs on my accounts looking for unusual POST activity. If I find bad behavior that becomes regular from the same IP address, I add it or the subnet to the IP deny list. I see many ...
0
votes
0answers
16 views

What kind of attack causes a JavaScript 'out of memory' on the attackers device?

We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
1
vote
0answers
23 views

Database of hacking attempt strings? [closed]

I have a strange URL request that's showing up in my logs, and I want to see if it's a hacking attempt. Is there a database or resource out there somewhere where I can see if this url is a common ...
2
votes
1answer
84 views

My website redirects to another website on google searches

I'm not sure if my website has been hacked or what have happened. When I do some searches on google in which my website should show up, my website with a different url name does. It maintains the ...
6
votes
2answers
232 views

Meaning of hack request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG Is this a known kind of attack? What might it be targeting?
1
vote
1answer
54 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
2
votes
2answers
215 views

How does Google prevent GA accounts from being spammed [closed]

Since the Google Analytics snippet is available in the source code of the page (e.g. below is stackexchange's) <script type="text/javascript">var ...
0
votes
0answers
10 views

How to stop parallel downloads

In my server logs I noticed random sets of IP's originating from china that are downloading the same file of about 16MB every couple of hours, and every time the computer downloads it, it starts the ...
2
votes
4answers
298 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
0
votes
0answers
38 views

Is a privacy policy page really necessary on pages designed for potential hackers?

I have a system setup on my server where users who consistently refresh the page at a ridiculously high rate are redirected to a special page where they have to wait a certain amount of time or to ...
1
vote
0answers
29 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
13 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
0
votes
1answer
169 views

What malware inserts a .htaccess redirect to Adf.ly?

I am hosting a few websites for customers, and a bunch of them have been hacked today. The hack consists of a simple .htaccess file that redirects to adf.ly. This is the second time I have been ...
3
votes
2answers
79 views

URL hijacked for spam [closed]

I'm the webmaster site/admin for a legitimate site http://cic.nyu.edu, built on drupal 7. I've updated drupal to the latest version. My issue is that it seems as if someone or somebot is using the url ...
0
votes
0answers
211 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
4
votes
4answers
329 views

Wordpress site hacked numerous times

Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible. ...
1
vote
2answers
50 views

After the home page was redirected by a hack, it is no longer indexed. How long until it comes back?

My site was hacked, and the index page was 302 redirected. It took me a few months to get all this sorted. In the meantime, the home page lost its PageRank and was no longer included in the index. I ...
0
votes
1answer
71 views

Reset Connection causing multiple errors after hack

We use webmaster tools to monitor our websites, and in the past couple of months some of our sites have been compromised and had various pages inserted. These pages created URLs that Google would ...
1
vote
2answers
103 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
2
votes
2answers
86 views

Server log what does “ho=<something>” mean?

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like: GET /bind.php ...
2
votes
2answers
158 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
0
votes
1answer
74 views

imaginaryTeachingToolUrl

I found an increased access to my website on www.mydomain.tld/imaginaryTeachingToolUrl. This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this ...
2
votes
5answers
433 views

Chinese bots in my forum

I have a small community forum that doesn't really get posts or any real traffic. The only thing that happens on the regular is bots with Chinese IPs signing up gibberish usernames. Most bots don't ...
1
vote
1answer
175 views

Site hacked: redirecting to other site?

I have a site that appears and works fine. However if you search for it in Google a whole lot of other links come up, eg: mysite.com/kamagra-viagra.html Clicking this I get redirected to the ...
0
votes
1answer
72 views

How to determine if someone is accessing our database remotely?

I own a content publishing website developed using CakePHP(tm) v 2.1.2 and 5.1.63 MySQL. It was developed by a freelance developer who kept remote access to the database which I wasn’t aware of. One ...
2
votes
1answer
134 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
2answers
67 views

How can we find real source of suspected user entries?

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these ...
6
votes
2answers
327 views

New requests for /cache/ URLs

A few weeks ago requests following this type of pattern: http://mysite/cache/7a226e8aa3a4380444a329a7b0dd0f40 http://mysite/otherfolder/cache/7a226e8aa3a4380444a329a7b0dd0f40 started to appear ...
4
votes
2answers
186 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
1
vote
2answers
1k views

What is HTML:imghack-a [Trj]?

One of my websites (Joomla) is being blocked by Avast when I try to go to the administrator page. I get the message that there is an HTML:imghack-a [Trj] threat. I guess its a trojan, but I cannot ...
2
votes
2answers
202 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
491 views

Site hack… but what is this?

My site have been hacked (i think) here is the code... the question, how to find what it does... <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\x75\156\x63\164\x69\157\x6e"; ...
1
vote
3answers
1k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
6
votes
2answers
820 views

Why do hackers inject hidden links?

I discovered a hacked site recently which has a div in it with a bunch of links to casinos at the top and the div is display:none;. I understand that black hats may hack sites in order to gain ...
3
votes
2answers
104 views

Am I being hacked or harvested? [closed]

I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 ...
1
vote
1answer
168 views

.htaccess keeps being deleted from my root directory

I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone ...
0
votes
1answer
270 views

JQuery Plugin files getting viruses even with CHMOD 755

I have a bunch of JQuery plugins (eg: masonry, isotope, carousel, etc) within a JavaScript folder in my root. These have been repeatedly infected with viruses making Google put alerts on my site. The ...
-1
votes
1answer
224 views

Need help in removing and forbidding some kind of malware in my website [closed]

I have a website based on Joomla 2.5. Recently people with AVG anti-virus started to complain that some strange windows appear when they open the site. An unknown line of code with comments "Google ...
2
votes
1answer
149 views

Script injection on different hosting servers = FTP hacking?

I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
2
votes
2answers
268 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
1answer
4k views

Are these hacking attempts or something less sinister?

I just had a look through our web server error logs, and Terminal services is reporting: "Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was ...
6
votes
4answers
358 views

How to discredit hacked links pointing at my company's website

The competition of one of my company's websites has started a really dirty campaign of acquiring hack links. One of their ingenious tactics has been to seed in links to OUR site withing their hack ...
2
votes
1answer
2k views

Joomla Sites hacked by DR-MTMRD [duplicate]

Possible Duplicate: My Sites Were Hacked. What To Do? A few of my joomla sites were hacked. After I became aware of this, I did these things: Changed hosting passwords (mysql, ftp, control ...
5
votes
1answer
176 views

Repeated calls with random Javascript append to the URL

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error( ...
2
votes
2answers
4k views

How can I fix the #c3284d# malvertising hack on my website?

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I ...
1
vote
2answers
3k views

Website hacked, cpanel password not encrypted?

Yesterday I found out that all the websites that are hosted on my webhosting site were hacked. I tried to change my password, and unbelievably, I COULD SEE my password there. This means my password is ...
2
votes
1answer
655 views

IIS executes “malicious.asp;.txt” as ASP file. What the?

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named ...
1
vote
1answer
321 views

What can I do about Hack Attempts

I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is ...
1
vote
4answers
127 views

Visitors download files in the same order every time - am I being hacked?

I'm running a website for a while and I'm still learning how to manage it. One thing I've noticed is that some visitors download all zip files in the same order ( there is a pattern of downloads). ...
0
votes
2answers
527 views

Traffic from site like pu.gg, goo.gl?

Why is it that I get pageviews from sites like pu.gg, goo.gl? What does it mean? Am I visited by hackers? Is there any way to block this kind of page view from my analytics? I am kind'a alarm with ...