Strange domain redirection, UFO's have visited my domain!?

Discussion in 'Domain Names' started by spiritfly, Nov 6, 2007.

  1. #1
    I wasn't paying attention to one of my domains lately, which is correctly setup to my host and is running wordpress with a few posts in it. When I opened it today I saw it redirects to another parked domain visitmacedonia.info ?! To be even weirder, it redirects to a parked domain which contains my country's name?!

    Here it is: smileyvideos (dot) info redirecting to visitmacedonia (dot) info

    I have pinged my domain and I noticed that it still has the ip of my host..

    Also checked my account at the domain registrar and it still points to the DNS's of my host..

    Do you guys have some reasonable explanation for this? Was I hacked or something?!
     
    spiritfly, Nov 6, 2007 IP
  2. Peter Brown

    Peter Brown Well-Known Member

    Messages:
    1,638
    Likes Received:
    117
    Best Answers:
    0
    Trophy Points:
    180
    #2
    I just checked Google cache and you had a link on the bottom of smileyvideos.info that takes you to visitmacedonia.info.

    What was "© http://visitmacedonia.info" doing at the bottom of the page?
     
    Peter Brown, Nov 6, 2007 IP
  3. spiritfly

    spiritfly Well-Known Member

    Messages:
    469
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    130
    #3
    To be honest I haven't got a clue.. It's not from the theme and I didn't put it there either..

    can it be that someone hacked my wordpress because it wasn't updated for some time?

    but whatever the reason is, this tells me that the redirecting is done through wordpress. Thanks for the good inspection there Peter, I'm going to check this out now.
     
    spiritfly, Nov 6, 2007 IP
  4. ruffnat

    ruffnat Peon

    Messages:
    394
    Likes Received:
    12
    Best Answers:
    0
    Trophy Points:
    0
    #4
    It is a good idea to always check the source of all of your sites, because hackers can take advantage of server vulnerabilities and insert code in.

    I was on a shared server and found bad code in one of my sites, I checked other people's sites on the same server and found a bunch of them were infected too.

    It pays to check these things often.
     
    ruffnat, Nov 6, 2007 IP
  5. spiritfly

    spiritfly Well-Known Member

    Messages:
    469
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    130
    #5
    I have just hunted down this to be a problem with a specific file in wordpress. I've tried renaming all the files and then loading the site and actually found out that when I rename the file: site/wp-includes/taxonomy.php into something else the site won't load at all.

    can someone tell me what this file does, and why it redirects me to another unknown to me domain?

    I've also searched all the files in my wordpress installation for the name of the site to which it redirects me, but there was no results..

    Maybe I should have posted this in the Wordpress section
     
    spiritfly, Nov 7, 2007 IP
  6. KiHack

    KiHack Banned

    Messages:
    1,050
    Likes Received:
    43
    Best Answers:
    0
    Trophy Points:
    0
    #6
    I think you should replace taxonomy.php with the original file, and try editing the PHP code.
    Send the file to me, I'll see if I can do something. Maybe the creator of the theme were the unknown site's owners?
     
    KiHack, Nov 7, 2007 IP