Help !!! My Site Is Being Hijacked!

Discussion in 'Site & Server Administration' started by nikolaalx, Jun 6, 2007.

  1. #1
    Hey all,
    I noticed that all of a sudden the traffic to my site stopped. the url is www.funzac.com

    I have checked it many times and it was working normal. Then I decided to check it through a proxy site, and I saw that once I typed the address, a different site opened for me.

    Can someone please help me identify how is my site being hijacked? and fix it asap!

    MAny reps to the person who helps.

    Thanks,
    Nik
     
    nikolaalx, Jun 6, 2007 IP
  2. alemcherry

    alemcherry Guest

    Best Answers:
    0
    #2
    Check which IP address it resolves to. try "ping www.funzac.com" from command prompt.

    if it resoves to your site and still redirect elsewhere, someone hacked your hosting account. Otherwise, problems with DNS settings/ domain name is hijacked.
     
    alemcherry, Jun 6, 2007 IP
  3. inworx

    inworx Peon

    Messages:
    4,860
    Likes Received:
    201
    Best Answers:
    0
    Trophy Points:
    0
    #3
    The site redirects here: http://mostplays.com/

    If you dont mind, please PM me with the cPanel information so that I can have more deep look in it.
     
    inworx, Jun 6, 2007 IP
  4. alemcherry

    alemcherry Guest

    Best Answers:
    0
    #4
    I get the following info:
    funzac.com [216.246.11.193]
    redirects to mostplays.com [216.104.33.30]

    You can FTP to funzac.com [216.246.11.193] and check what kames the redirection. Either it will be an .htaccess file or index.php or something.

    You can also get the who is for the new site and inspect the logs to investigate who the site is redirecting to and how it happened.
     
    alemcherry, Jun 6, 2007 IP
  5. nikolaalx

    nikolaalx Well-Known Member

    Messages:
    996
    Likes Received:
    19
    Best Answers:
    0
    Trophy Points:
    100
    #5
    Thank you guys, I am looking at the index currently.
     
    nikolaalx, Jun 6, 2007 IP
  6. inworx

    inworx Peon

    Messages:
    4,860
    Likes Received:
    201
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Is there anything in .htaccess file?
     
    inworx, Jun 6, 2007 IP
  7. bouncer69

    bouncer69 Peon

    Messages:
    978
    Likes Received:
    43
    Best Answers:
    0
    Trophy Points:
    0
    #7
    bouncer69, Jun 6, 2007 IP
  8. nikolaalx

    nikolaalx Well-Known Member

    Messages:
    996
    Likes Received:
    19
    Best Answers:
    0
    Trophy Points:
    100
    #8
    I have fixed it.

    That bastard made me open the site normally, but everyone was getting redirected. He used geo targeting, and made everyone from my country to open it properly :) lol

    cheers all, and thanks for your help.
     
    nikolaalx, Jun 6, 2007 IP
  9. nikolaalx

    nikolaalx Well-Known Member

    Messages:
    996
    Likes Received:
    19
    Best Answers:
    0
    Trophy Points:
    100
    #9
    Btw what can we do about it. The perpetrator owns mostplays.com . I personally lack the skills to do anything to him, but if anyone else wants...be my guest :)
     
    nikolaalx, Jun 6, 2007 IP
  10. ndreamer

    ndreamer Guest

    Messages:
    339
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #10
    contact his host, domain register and maybe even google.
     
    ndreamer, Jun 6, 2007 IP
  11. ndreamer

    ndreamer Guest

    Messages:
    339
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #11
    i did a quick google search and found that he also placed links on your site to his they seem to appear on all the game pages.
    http://www.funzac.com/play/Kirby.html
    http://www.funzac.com/play/Aircrafts Race.html

    the link is located in your left nav bar using the anchor text MostPlays
    may want to look though your site for any other links he may have left behind.
     
    ndreamer, Jun 7, 2007 IP
    Radamanto and nikolaalx like this.
  12. inworx

    inworx Peon

    Messages:
    4,860
    Likes Received:
    201
    Best Answers:
    0
    Trophy Points:
    0
    #12
    inworx, Jun 8, 2007 IP
  13. nikolaalx

    nikolaalx Well-Known Member

    Messages:
    996
    Likes Received:
    19
    Best Answers:
    0
    Trophy Points:
    100
    #13
    I have just contacted the hosting. It appears that he uses the same hosting like I do. What nerves this guy has for making such evident hack and thinking that no one will notice. :mad:



    Thank you ndreamer!
     
    nikolaalx, Jun 10, 2007 IP