Advertisement:

Author Topic: has my site been hacked? please help  (Read 976 times)

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
has my site been hacked? please help
« on: March 20, 2017, 09:20:35 PM »
I just found out that my my site redirects to another site for example http://mysite.com/~unknownsite.com/ leads me to the unknown site url.
I cant seem to find /~unknownsite.com/ in my root folder in cpanel which means i can't remove it.
Please help

Offline Sir Osis of Liver

  • Support Specialist
  • SMF Hero
  • *
  • Posts: 5,795
  • Eat, drink, and be buried.
Re: has my site been hacked? please help
« Reply #1 on: March 20, 2017, 10:02:59 PM »
If you can pm ftp access (server/username/password) will have a look.

Offline Illori

  • Project Manager
  • SMF Master
  • *
  • Posts: 45,909
Re: has my site been hacked? please help
« Reply #2 on: March 21, 2017, 05:11:18 AM »
or if you can provide us with a valid URL so we can look into the issue we may be able to offer more advise on how to resolve the issue.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #3 on: March 21, 2017, 07:06:50 AM »
Here is my site URL http://afriwap.com/
http://afriwap.com/~infoway/ leads to an unknown site

Offline Illori

  • Project Manager
  • SMF Master
  • *
  • Posts: 45,909
Re: has my site been hacked? please help
« Reply #4 on: March 21, 2017, 07:28:42 AM »
i am not getting any redirect, but i would recommend you put index.php back in your URL as removing it is known to cause issues.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #5 on: March 21, 2017, 09:47:53 AM »
i am not getting any redirect, but i would recommend you put index.php back in your URL as removing it is known to cause issues.
that wouldn't fix it...
http://afriwap.com/~infoway/ leads to another website that i have no idea of.
I don't know how /~infoway was created that...

Offline Illori

  • Project Manager
  • SMF Master
  • *
  • Posts: 45,909
Re: has my site been hacked? please help
« Reply #6 on: March 21, 2017, 10:13:20 AM »
Ask your host. I bet that is another website they hosting.

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 53,902
  • Gender: Male
    • Kindred-999 on GitHub
Re: has my site been hacked? please help
« Reply #7 on: March 21, 2017, 11:37:25 AM »
yup...   I get a blocked warning indicating a redirect to a known dangerous site...

It looks like you may have been hacked at some point.

So...   What version of SMF are you runinng?
What mods?
Are you running any OTHER software on the website?
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #8 on: March 21, 2017, 01:06:05 PM »
The site is running on SMF 2.0.13
And this are the mods installed








Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 53,902
  • Gender: Male
    • Kindred-999 on GitHub
Re: has my site been hacked? please help
« Reply #9 on: March 21, 2017, 01:59:58 PM »
In the future, when asked for a list of mods, please use a TEXT listing instead of an image.

What about the final question?
Are you running any OTHER software on the website?
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #10 on: March 21, 2017, 02:29:52 PM »
In the future, when asked for a list of mods, please use a TEXT listing instead of an image.

What about the final question?
Are you running any OTHER software on the website?
sorry about that...
I am not using any software on the site

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 53,902
  • Gender: Male
    • Kindred-999 on GitHub
Re: has my site been hacked? please help
« Reply #11 on: March 21, 2017, 02:50:16 PM »
Hmmm.... so, SMF is the only thing running on your site?

Did you give Sir Osis of Liver the FTP access that he requested?
If so, he can hopefully check your files and logs.

I would recommend also checking with your host and asking them to do a filecheck of your site.


SOMETHING has been compromised...  we know of no security issues in 2.0.13, so either the used a different route (another software, another site on a poorly configured server, etc) or there is something that we need to track down with the help of you and your host.
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #12 on: March 21, 2017, 07:42:27 PM »
Okay i contacted my host and told them about the issue, i also demanded explanation on how ~infoway gained access to my site url ( http://afriwap.com/~infoway/imgs/mei.php)
As explained by them (My host), infoway is the username that belongs to a site in the same shared server with my site (afriwap.com)

Offline Colin

  • Lead Developer
  • SMF Hero
  • *
  • Posts: 7,364
  • Gender: Male
  • SMF Developer
    • colinschoen on GitHub
Re: has my site been hacked? please help
« Reply #13 on: March 21, 2017, 07:47:16 PM »
Is this your personal hosting account or are you sharing this (shared) hosting account with someone else?
"If everybody is thinking alike, then somebody is not thinking." - Gen. George S. Patton Jr.

Colin

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 53,902
  • Gender: Male
    • Kindred-999 on GitHub
Re: has my site been hacked? please help
« Reply #14 on: March 21, 2017, 07:59:35 PM »
If infoway is a completely separate and unrelated hosting account on the same server, then you need to leave that host like your pants are in fire...   get out and get a reputable host who knows how to configure their server
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline timidapsin

  • Jr. Member
  • **
  • Posts: 130
Re: has my site been hacked? please help
« Reply #15 on: March 21, 2017, 08:00:31 PM »
Is this your personal hosting account or are you sharing this (shared) hosting account with someone else?
Shared hosting