Questions tagged [hacking]
If your website may have been compromised, use the [hacked-site] tag. Use this tag for more general questions about someone accessing a system in an unintended way.
90
questions
0
votes
0
answers
22
views
Wordpress login attempts with personalized data
I recently got some login attempts on a self-hosted Wordpress site that make me a little bit nervous: The login attempts are non-standard usernames like "admin" or "root". They ...
2
votes
1
answer
242
views
How long until Google correctly indexes a site that had been hacked?
A couple of weeks ago my WordPress site suffered a conditional redirection hack:
While I can browse my website without any problem, my Home appears in the Google Search results with spam data, the ...
- 121
13
votes
1
answer
21k
views
Vulnerability in /boaform/admin/formLogin?
I am getting this HTTP request line on my server (simple http server). The normal action for this request on my server is to simply close the socket connection. I am asking this question because when ...
- 253
2
votes
2
answers
1k
views
Why is my regional website being hit by thousands of Chinese IP addresses?
For a few days now one of my websites (a local travel guide) has been getting a massive number of hits from Chinese IP addresses. This is to the point that my log files are 10 times bigger and my ...
0
votes
0
answers
570
views
The website is facing a Japanese keyword hack issue. What to do? [duplicate]
We are currently facing a Japanese keyword hack issue on our website (https://example.com/). The issue is faced on 25-11-2019 when we got the mail that shows someone is the new google search console ...
1
vote
2
answers
91
views
Block any other domains from using my server
Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
- 11
1
vote
1
answer
1k
views
Why are hacking attempts coming from IP addresses owned by Google?
I catch, save, and report all suspicious or malicious acts against my servers. Among the things I track are port scans on vulnerable ports (including the default ports for SSH, RDP, Plesk, and Webmin, ...
- 325
1
vote
0
answers
52
views
How to stop someone else using up our Google Map API quota
Our website has been using a few google map api to display map, auto-complete addresses, geo-coding, etc.. We followed best practices from google to protect the key such as limit referrer to ourdomain....
- 151
1
vote
0
answers
79
views
Why would a person or bot visit my "about us" page three times every day?
Something strange happens on my site (which is on 6 languages):
I use statcounter for monitoring the website.
In the last 3-4 months, I observed that at least 3 times per day, one page is "visited", ...
- 59
1
vote
1
answer
60
views
Should we use Amazon CloudFront? (We need mitigate cost attacks)
We want to serve our files from Amazon S3.
We are worried about cost DoS attacks (deliberately downloading files from Amazon many times, in order for us to pay a big bill to Amazon).
We don't have ...
- 383
1
vote
0
answers
44
views
Invalid URLs with 5 character prefixes
I've been getting lots of attempts to access pages on my site with 5 upper/lowercase chars as the first path. For example:
/aOKTW/validpage
That first 5 character path is always different. I ...
- 242
2
votes
4
answers
554
views
Should I redirect login / admin pages to the home page?
I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to
/wp-login.php (the Wordpress default ...
- 215
0
votes
2
answers
100
views
How to get my site spammed? [closed]
I know this might be an unusual question as most people will usually want the opposite as what I’m asking for, but I want to run an experiment and I would like to get my own site spammed.
Spam ...
- 385
4
votes
1
answer
373
views
Solving corruption in a .htaccess flle
I received a call from Go Daddy indicating that my site had been hacked and the .htaccess file is now an issue.
The code in my .htaccess file is as follows
RewriteEngine On
RewriteCond %{...
0
votes
1
answer
76
views
Website Blog Hacked. Solution Required [closed]
The blog section of my website is currently hacked. When I do a site: I can find a lot of new pages with Japanese text(randomly creating directories) that have been indexed. I have gone through the ...
- 1
8
votes
2
answers
5k
views
Why is my site getting requests for URLs converted to lowercase?
On my sites I am seeing requests for what would be valid URLs, but with the path converted to lowercase.
For example, a valid URL is example.com/some-product-CAT12P0.html.
In my Apache logs I'm ...
- 417
2
votes
1
answer
93
views
Another domain hosting my content
I recently created a website of my own after buying domain name from namecheap and hosting it on digitaloceans.
http://piyushkhemka.me
After googling my own name after a few days, I see this website ...
- 121
1
vote
1
answer
247
views
Googlebot spamming?
We run a sailing website and offer measurement forms for sails and what not -- recently we've been getting hit with hundreds of form submissions with random letters and names in the blanks and it's ...
- 11
0
votes
1
answer
57
views
Should captcha be used on every vulnerable page, or just on initial page load to deter robots?
I do not know too much about how hackers compromise websites but am careful about sanitizing all posted data.
I am using Google ReCaptcha on most of the pages on a website. Would it suffice to have ...
- 223
1
vote
1
answer
89
views
website marked as "may be hacked" by google
My website is marked by google as "may be hacked". Through the admin panel of google search console, I see several links that are list as "URL injections".
My site is built with opencart. As you can ...
- 505
1
vote
1
answer
67
views
Wordpress site constantly bruted forced even though there is no wp-login.php page
After being attacked many times and compromised I installed Sucuri for monitoring.
Seeing how many times a day I was being brute forced, I decided to turn off the wp login page, but I still get ...
- 111
1
vote
0
answers
559
views
My info@ email address keeps sending SPAM mails
Since somewhere in april my info@ email address is being used to send SPAM emails. I first noticed it when I received a 'Mail Delivery System' email with the message that an email couldn't be sent ...
- 111
3
votes
1
answer
72
views
Website content was copied resulting in decreased traffic
My website with automobile niche has been struggling to stand again plagiarism and bot-attacks from last few months.In last quarter, 3 different domains were setup with exact replica of all the ...
- 33
1
vote
0
answers
319
views
Receiving errors for a domain I don't control
I have my site set up to email me whenever an error happens, and recently I've been getting an occasional notification (a few per day) about a page not found error, but the weird thing is that the ...
- 11
3
votes
2
answers
876
views
How can I avoid being hacked? [closed]
I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content.
RewriteEngine On
RewriteCond %{HTTP_ACCEPT} "text/...
- 446
5
votes
3
answers
7k
views
How to determine if a user agent string has proper syntax or might be a hacking attempt?
I was checking my server via awstats to see who was visiting my site and I have a user-agent of the following value:
}__test|O:21:\
Some research has lead me to believe that someone was trying to ...
- 13.6k
3
votes
1
answer
241
views
Someone else set up a trial Google Apps account on my domain. How can I get Google to disable it?
I own my domain (say, mydomain.com) and administer it through my hosting provider. A couple of days ago, I started receiving mail from Google Apps addressed to [email protected]. There's ...
- 165
3
votes
1
answer
127
views
Brute force attack traced to a specific web host
My website was recently brute force attacked. An agent attempted to log in by guessing various user and password combinations.
The I.P. address was traced to hosting company in Germany. I contacted ...
- 133
0
votes
1
answer
328
views
Preventing phpMyAdmin hacks
I recently saw an unexpected error in my error log, and upon investigating, found it repeated many times. What are the deviants trying to accomplish, and is there any risk of them accomplishing it.
[...
- 243
1
vote
0
answers
45
views
Query strings showing in SERPs
One of our sites got hacked, we believe we have resolved this issue, but when doing a site:example.com in Google, we are still seeing query strings like: example.com/?black-book-subtitles.
Could it ...
- 11
1
vote
2
answers
2k
views
Site search results showing strange foreign letters and images
I'm having some strange characters show up on a site search using Google. I've gone through the WordPress files and could not find anything strange. Also ran a malware detect on the site. The ...
- 111
1
vote
1
answer
276
views
I found some weird exploit
I call it 'Meta-jacking'.
So this website I found has a meta with content="" and whatever you type in the description displays your text in the content. So I took advantage of this and typed:
0;//...
- 13
1
vote
1
answer
51
views
How to hide error log from hackers? [duplicate]
I'm a developer of self hosted web application. which creates the error log but others can access it rather than only admin of that application. is there any way to protect it from page other people ...
- 111
1
vote
1
answer
57
views
What kind of attack causes a JavaScript 'out of memory' on the attackers device?
We experienced a strange attack yesterday.
Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
- 11
3
votes
1
answer
615
views
My website redirects to another website on google searches
I'm not sure if my website has been hacked or what have happened.
When I do some searches on google in which my website should show up, my website with a different url name does. It maintains the ...
- 133
2
votes
1
answer
87
views
Suspicious script loads ONLY when navigating to site via search engines
I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
- 23
1
vote
1
answer
144
views
How to stop parallel downloads
In my server logs I noticed random sets of IP's originating from china that are downloading the same file of about 16MB every couple of hours, and every time the computer downloads it, it starts the ...
- 13.6k
2
votes
1
answer
161
views
Is a privacy policy page really necessary on pages designed for potential hackers?
I have a system setup on my server where users who consistently refresh the page at a ridiculously high rate are redirected to a special page where they have to wait a certain amount of time or to ...
- 13.6k
1
vote
0
answers
53
views
Security and Apache Methods
I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking.
My site does not have but one form. Outside of this, POST should not exist ...
- 32.8k
0
votes
0
answers
15
views
WordPress site hacked, recovered but Google still has hacked page description [duplicate]
My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed.
I suspected the code came through a ...
- 1
0
votes
1
answer
786
views
What malware inserts a .htaccess redirect to Adf.ly?
I am hosting a few websites for customers, and a bunch of them have been hacked today. The hack consists of a simple .htaccess file that redirects to adf.ly.
This is the second time I have been ...
- 1
4
votes
2
answers
136
views
URL hijacked for spam [closed]
I'm the Webmaster and administrator for a site, built on Drupal 7. I've updated Drupal to the latest version. My issue is that it seems as if someone or somebot is using our url. Has my legitimate ...
- 41
5
votes
4
answers
638
views
Wordpress site hacked numerous times
Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible.
...
- 372
2
votes
2
answers
66
views
After the home page was redirected by a hack, it is no longer indexed. How long until it comes back?
My site was hacked, and the index page was 302 redirected. It took me a few months to get all this sorted. In the meantime, the home page lost its PageRank and was no longer included in the index.
I ...
- 393
0
votes
1
answer
92
views
Reset Connection causing multiple errors after hack
We use webmaster tools to monitor our websites, and in the past couple of months some of our sites have been compromised and had various pages inserted. These pages created URLs that Google would ...
- 3
1
vote
2
answers
891
views
How do I prevent access to SPAM URLs and remove them from Google's index?
When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
- 283
4
votes
2
answers
654
views
Parallel website running a copy of my original website
We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
- 295
0
votes
1
answer
130
views
imaginaryTeachingToolUrl
I found an increased access to my website on
www.mydomain.tld/imaginaryTeachingToolUrl.
This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this ...
- 103
2
votes
7
answers
2k
views
WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?
I don't really know how to express my problem, so bear with me. This is a bit hard to explain.
I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
- 21
2
votes
1
answer
528
views
What was this hack-bot trying to achieve via directory traversal?
I was walking through my server logs and the following kinda stunned me:
ACCESS ERROR 404 from IP 62.112.152.161:
Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00
...
- 273