Questions tagged [hacking]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
6
votes
4answers
471 views

How to discredit hacked links pointing at my company's website

The competition of one of my company's websites has started a really dirty campaign of acquiring hack links. One of their ingenious tactics has been to seed in links to OUR site withing their hack bot,...
6
votes
2answers
1k views

Why do hackers inject hidden links?

I discovered a hacked site recently which has a div in it with a bunch of links to casinos at the top and the div is display:none;. I understand that black hats may hack sites in order to gain ...
6
votes
1answer
633 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
6
votes
2answers
3k views

Why is my site getting requests for URLs converted to lowercase?

On my sites I am seeing requests for what would be valid URLs, but with the path converted to lowercase. For example, a valid URL is example.com/some-product-CAT12P0.html. In my Apache logs I'm ...
6
votes
2answers
471 views

Meaning of hack request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG Is this a known kind of attack? What might it be targeting?
6
votes
2answers
377 views

New requests for /cache/ URLs

A few weeks ago requests following this type of pattern: http://mysite/cache/7a226e8aa3a4380444a329a7b0dd0f40 http://mysite/otherfolder/cache/7a226e8aa3a4380444a329a7b0dd0f40 started to appear ...
5
votes
4answers
533 views

Wordpress site hacked numerous times

Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible. ...
5
votes
1answer
204 views

Repeated calls with random Javascript append to the URL

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error( /UI/Includes/JavaScript/,C,!1),a....
4
votes
7answers
472 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
4
votes
2answers
626 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
4
votes
3answers
5k views

How to determine if a user agent string has proper syntax or might be a hacking attempt?

I was checking my server via awstats to see who was visiting my site and I have a user-agent of the following value: }__test|O:21:\ Some research has lead me to believe that someone was trying to ...
4
votes
3answers
1k views

Google says my site contains malware

my clients site http://bit.ly/dTOfGF (i used url shortener). I have tried everything to find the malware but i couldnt. I tried the Google checklist http://googlewebmastercentral.blogspot.com/2007/...
4
votes
2answers
133 views

URL hijacked for spam [closed]

I'm the Webmaster and administrator for a site, built on Drupal 7. I've updated Drupal to the latest version. My issue is that it seems as if someone or somebot is using our url. Has my legitimate ...
4
votes
2answers
246 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
4
votes
1answer
158 views

Solving corruption in a .htaccess flle

I received a call from Go Daddy indicating that my site had been hacked and the .htaccess file is now an issue. The code in my .htaccess file is as follows RewriteEngine On RewriteCond %{...
3
votes
5answers
1k views

Chinese bots in my forum

I have a small community forum that doesn't really get posts or any real traffic. The only thing that happens on the regular is bots with Chinese IPs signing up gibberish usernames. Most bots don't ...
3
votes
2answers
864 views

How can I avoid being hacked? [closed]

I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content. RewriteEngine On RewriteCond %{HTTP_ACCEPT} "text/...
3
votes
1answer
211 views

Someone else set up a trial Google Apps account on my domain. How can I get Google to disable it?

I own my domain (say, mydomain.com) and administer it through my hosting provider. A couple of days ago, I started receiving mail from Google Apps addressed to jyotioffsetjsm01@mydomain.com. There's ...
3
votes
1answer
596 views

My website redirects to another website on google searches

I'm not sure if my website has been hacked or what have happened. When I do some searches on google in which my website should show up, my website with a different url name does. It maintains the ...
3
votes
1answer
122 views

Brute force attack traced to a specific web host

My website was recently brute force attacked. An agent attempted to log in by guessing various user and password combinations. The I.P. address was traced to hosting company in Germany. I contacted ...
3
votes
1answer
187 views

Script injection on different hosting servers = FTP hacking?

I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
3
votes
2answers
148 views

Am I being hacked or harvested? [closed]

I just did some log analysis of Q1 for one of my client's sites. There were about 30,000 sessions created for this site for each of the five separate IP addresses starting with 79.171.81.xxx. 150,000 ...
3
votes
1answer
5k views

Are these hacking attempts or something less sinister?

I just had a look through our web server error logs, and Terminal services is reporting: "Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was ...
2
votes
7answers
2k views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
2
votes
4answers
495 views

Should I redirect login / admin pages to the home page?

I'm on a security kick right now and my current project is a server with a Wordpress site (that used to be a Joomla site). I sometimes get 50 requests a day to /wp-login.php (the Wordpress default ...
2
votes
2answers
248 views

How does Google prevent GA accounts from being spammed [closed]

Since the Google Analytics snippet is available in the source code of the page (e.g. below is stackexchange's) <script type="text/javascript">var _gaq=_gaq||[];_gaq.push(['_setAccount','UA-...
2
votes
2answers
564 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
2
votes
1answer
2k views

Joomla Sites hacked by DR-MTMRD [duplicate]

Possible Duplicate: My Sites Were Hacked. What To Do? A few of my joomla sites were hacked. After I became aware of this, I did these things: Changed hosting passwords (mysql, ftp, control panel) ...
2
votes
2answers
120 views

Are we being attacked?

We serve a 13mb download which is reasonably popular, around 150-300 downloads a day. Today we have had 1,200 downloads and as I browse the logs I find they all originate from the same IP address. ...
2
votes
3answers
359 views

POST attack on my website

I have a site (humanisms.co.uk) which incorporates a voting system, ie. user clicks "Up" and it sends a parameter to a PHP script via AJAX, the PHP inserts vote into MYSQL db and the new "Up" vote is ...
2
votes
2answers
64 views

After the home page was redirected by a hack, it is no longer indexed. How long until it comes back?

My site was hacked, and the index page was 302 redirected. It took me a few months to get all this sorted. In the meantime, the home page lost its PageRank and was no longer included in the index. I ...
2
votes
2answers
381 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
2answers
4k views

How can I fix the #c3284d# malvertising hack on my website?

For the past couple of weeks at semi regular intervals, this website has had the #c3284d# malware code inserted into some of its .php files. Also the .htaccess file had its equivelant code inserted. I ...
2
votes
1answer
79 views

Another domain hosting my content

I recently created a website of my own after buying domain name from namecheap and hosting it on digitaloceans. http://piyushkhemka.me After googling my own name after a few days, I see this website ...
2
votes
1answer
79 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
2
votes
2answers
719 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
2k views

IIS executes “malicious.asp;.txt” as ASP file. What the?

I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named dz.asp;....
2
votes
1answer
453 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
2
votes
1answer
1k views

.htaccess keeps being deleted from my root directory

I have a site built on the ModX Evo CMS. I have noticed that almost every day the .htaccess file is deleted meaning the FURLs no longer work. I have scanned for viruses and found nothing. Does anyone ...
2
votes
2answers
258 views

Why is my regional website being hit by thousands of Chinese IP addresses?

For a few days now one of my websites (a local travel guide) has been getting a massive number of hits from Chinese IP addresses. This is to the point that my log files are 10 times bigger and my ...
2
votes
1answer
60 views

Website content was copied resulting in decreased traffic

My website with automobile niche has been struggling to stand again plagiarism and bot-attacks from last few months.In last quarter, 3 different domains were setup with exact replica of all the ...
2
votes
1answer
151 views

Is a privacy policy page really necessary on pages designed for potential hackers?

I have a system setup on my server where users who consistently refresh the page at a ridiculously high rate are redirected to a special page where they have to wait a certain amount of time or to ...
2
votes
1answer
595 views

Site hack… but what is this?

My site have been hacked (i think) here is the code... the question, how to find what it does... <?php $zend_framework="\x63\162\x65\141\x74\145\x5f\146\x75\156\x63\164\x69\157\x6e"; @...
2
votes
1answer
141 views

Effective combatting of 100's of spam links in Google Results

I have recently been the victim of this hacking exploit (blog post is for reference only and is not my site. I'm in the process of following it and cleaning up after the attack). Note the exploit at ...
1
vote
4answers
142 views

Visitors download files in the same order every time - am I being hacked?

I'm running a website for a while and I'm still learning how to manage it. One thing I've noticed is that some visitors download all zip files in the same order ( there is a pattern of downloads). I'...
1
vote
2answers
118 views

Server log what does “ho=<something>” mean?

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like: GET /bind.php ho=mx01.1and1.es&po=25&ma=cristina%40bpmlighting.com&lo=cristina&...
1
vote
1answer
344 views

Why are hacking attempts coming from IP addresses owned by Google?

I catch, save, and report all suspicious or malicious acts against my servers. Among the things I track are port scans on vulnerable ports (including the default ports for SSH, RDP, Plesk, and Webmin, ...
1
vote
2answers
413 views

What can I do about Hack Attempts

I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is ...
1
vote
2answers
63 views

Block any other domains from using my server

Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
1
vote
2answers
77 views

How can we find real source of suspected user entries?

I have a website where I keep logging the user entries. I found some anonymous entries in my table and I suspect they are using some kind of proxy switchers. How can I find the real source of these ...