The tag has no usage guidance.

learn more… | top users | synonyms

6
votes
4answers
404 views

How to discredit hacked links pointing at my company's website

The competition of one of my company's websites has started a really dirty campaign of acquiring hack links. One of their ingenious tactics has been to seed in links to OUR site withing their hack bot,...
6
votes
2answers
931 views

Why do hackers inject hidden links?

I discovered a hacked site recently which has a div in it with a bunch of links to casinos at the top and the div is display:none;. I understand that black hats may hack sites in order to gain ...
6
votes
1answer
427 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
6
votes
2answers
302 views

Meaning of hack request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG Is this a known kind of attack? What might it be targeting?
6
votes
2answers
355 views

New requests for /cache/ URLs

A few weeks ago requests following this type of pattern: http://mysite/cache/7a226e8aa3a4380444a329a7b0dd0f40 http://mysite/otherfolder/cache/7a226e8aa3a4380444a329a7b0dd0f40 started to appear ...
5
votes
3answers
751 views

My Sites Were Hacked. What To Do?

I host multiple domains with this very popular hosting provider and I just went into one of my sites and... I see a black page with message "Hacked by...". I checked and all my sites with the provider ...
5
votes
1answer
136 views

Someone else set up a trial Google Apps account on my domain. How can I get Google to disable it?

I own my domain (say, mydomain.com) and administer it through my hosting provider. A couple of days ago, I started receiving mail from Google Apps addressed to jyotioffsetjsm01@mydomain.com. There's ...
5
votes
1answer
186 views

Repeated calls with random Javascript append to the URL

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error( /UI/Includes/JavaScript/,C,!1),a....
4
votes
4answers
379 views

Wordpress site hacked numerous times

Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible. ...
4
votes
7answers
459 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
4
votes
3answers
1k views

Google says my site contains malware

my clients site http://bit.ly/dTOfGF (i used url shortener). I have tried everything to find the malware but i couldnt. I tried the Google checklist http://googlewebmastercentral.blogspot.com/2007/...
4
votes
2answers
115 views

URL hijacked for spam [closed]

I'm the Webmaster and administrator for a site, built on Drupal 7. I've updated Drupal to the latest version. My issue is that it seems as if someone or somebot is using our url. Has my legitimate ...
4
votes
2answers
220 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
3
votes
2answers
210 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
3
votes
2answers
368 views

How can I avoid being hacked? [closed]

I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content. RewriteEngine On RewriteCond %{HTTP_ACCEPT} "text/...
3
votes
3answers
92 views

How to determine if a user agent string has proper syntax or might be a hacking attempt?

I was checking my server via awstats to see who was visiting my site and I have a user-agent of the following value: }__test|O:21:\ Some research has lead me to believe that someone was trying to ...
3
votes
1answer
178 views

My website redirects to another website on google searches

I'm not sure if my website has been hacked or what have happened. When I do some searches on google in which my website should show up, my website with a different url name does. It maintains the ...
3
votes
1answer
80 views

Brute force attack traced to a specific web host

My website was recently brute force attacked. An agent attempted to log in by guessing various user and password combinations. The I.P. address was traced to hosting company in Germany. I contacted ...
3
votes
2answers
124 views

Am I being hacked or harvested? [closed]

I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 ...
3
votes
1answer
5k views

Are these hacking attempts or something less sinister?

I just had a look through our web server error logs, and Terminal services is reporting: "Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was ...
2
votes
2answers
229 views

How does Google prevent GA accounts from being spammed [closed]

Since the Google Analytics snippet is available in the source code of the page (e.g. below is stackexchange's) <script type="text/javascript">var _gaq=_gaq||[];_gaq.push(['_setAccount','UA-...
2
votes
2answers
525 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
2
votes
5answers
600 views

Chinese bots in my forum

I have a small community forum that doesn't really get posts or any real traffic. The only thing that happens on the regular is bots with Chinese IPs signing up gibberish usernames. Most bots don't ...
2
votes
2answers
94 views

Server log what does “ho=<something>” mean?

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like: GET /bind.php ho=mx01.1and1.es&po=25&ma=cristina%40bpmlighting.com&lo=cristina&...
2
votes
1answer
2k views

Joomla Sites hacked by DR-MTMRD [duplicate]

Possible Duplicate: My Sites Were Hacked. What To Do? A few of my joomla sites were hacked. After I became aware of this, I did these things: Changed hosting passwords (mysql, ftp, control ...
2
votes
2answers
114 views

Are we being attacked?

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day. Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. ...
2
votes
3answers
348 views

POST attack on my website

I have a site (humanisms.co.uk) which incorporates a voting system, ie. user clicks "Up" and it sends a parameter to a PHP script via AJAX, the PHP inserts vote into MYSQL db and the new "Up" vote is ...
2
votes
2answers
339 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
2answers
4k views

How can I fix the #c3284d# malvertising hack on my website?

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I ...
2
votes
1answer
71 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
2
votes
2answers
305 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
792 views

IIS executes “malicious.asp;.txt” as ASP file. What the?

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named dz.asp;....
2
votes
1answer
237 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
2
votes
1answer
161 views

Script injection on different hosting servers = FTP hacking?

I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
2
votes
1answer
51 views

Website content was copied resulting in decreased traffic

My website with automobile niche has been struggling to stand again plagiarism and bot-attacks from last few months.In last quarter, 3 different domains were setup with exact replica of all the ...
2
votes
4answers
532 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
2
votes
1answer
536 views

Site hack… but what is this?

My site have been hacked (i think) here is the code... the question, how to find what it does... <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\x75\156\x63\164\x69\157\x6e"; @...
2
votes
1answer
133 views

Effective combatting of 100's of spam links in Google Results

I have recently been the victim of this hacking exploit (blog post is for reference only and is not my site. I'm in the process of following it and cleaning up after the attack). Note the exploit at ...
2
votes
3answers
361 views

Hacker Crawler inserting iframe into ftp file

Somehow, a "hacker crawler" is constantly inserting a harmful iframe-line into one of my files: It's done automatically, and not by a person, I assume. I've changed all my passwords several times ...
1
vote
3answers
2k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
1
vote
4answers
127 views

Visitors download files in the same order every time - am I being hacked?

I'm running a website for a while and I'm still learning how to manage it. One thing I've noticed is that some visitors download all zip files in the same order ( there is a pattern of downloads). I'...
1
vote
2answers
70 views

How can we find real source of suspected user entries?

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these ...
1
vote
2answers
3k views

Website hacked, cpanel password not encrypted?

Yesterday I found out that all the websites that are hosted on my webhosting site were hacked. I tried to change my password, and unbelievably, I COULD SEE my password there. This means my password is ...
1
vote
1answer
112 views

I found some weird exploit

I call it 'Meta-jacking'. So this website I found has a meta with content="" and whatever you type in the description displays your text in the content. So I took advantage of this and typed: 0;//...
1
vote
1answer
23 views

How to hide error log from hackers? [duplicate]

I'm a developer of self hosted web application. which creates the error log but others can access it rather than only admin of that application. is there any way to protect it from page other people ...
1
vote
2answers
59 views

After the home page was redirected by a hack, it is no longer indexed. How long until it comes back?

My site was hacked, and the index page was 302 redirected. It took me a few months to get all this sorted. In the meantime, the home page lost its PageRank and was no longer included in the index. I ...
1
vote
2answers
266 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
1
vote
2answers
306 views

Site hacked: redirecting to other site?

I have a site that appears and works fine. However if you search for it in Google a whole lot of other links come up, eg: mysite.com/kamagra-viagra.html Clicking this I get redirected to the ...
1
vote
1answer
229 views

.htaccess keeps being deleted from my root directory

I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone ...
1
vote
1answer
335 views

What can I do about Hack Attempts

I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is ...