Server Hacked!

[El Hombre]

Please check out information on this at the new thread:
http://forums.hostgator.com/showthread.php?t=27629


Every one of the sites in my reseller account has been hacked, I have just been told by live chat that its a server wide problem and should be restored from last Sunday's back ups soon.
Any one know what's going on?

[Sam]

The whole server got hacked??

[El Hombre]

Thats what I just got told by live chat.
Every one of my sites about 30 of them hosted on my reseller account has the pages hacked. I just got onto live chat and I got told they knew about it, not to put a support ticket in and it would be restored in about an hour.

[Sam]

Originally Posted by El Hombre

Thats what I just got told by live chat.
Every one of my sites about 30 of them hosted on my reseller account has the pages hacked. I just got onto live chat and I got told they knew about it, not to put a support ticket in and it would be restored in about an hour.

What server was it? It's not like hostgator to get hacked

[El Hombre]

Anyone else got this problem or know anything about it?

[El Hombre]

How can I tell which server I am on?

[Sam]

Originally Posted by El Hombre

How can I tell which server I am on?

It will say in mail headers.

[El Hombre]

Dont know if this is it but when I create a new account it comes up ns147.websitewelcome.com also in my details on the forum here it shows the address 70.86.179.226 any of them help?

[Sam]

Originally Posted by El Hombre

Dont know if this is it but when I create a new account it comes up ns147.websitewelcome.com also in my details on the forum here it shows the address 70.86.179.226 any of them help?

ram.websitewelcome.com

I think i was on that server before i went dedicated

[CT Internet]

You are lucky that you got a reply from livechat I was told to wait... it has now been more than an hour, nothing has happened.

The server is ram.websitewelcome.com and there is some sort of script running on the server that keeps hacking the sites even after fixing them. The hack is a deface by "ThE PaLesTiNiaN HaCkeR"

I cases like this they should just shut down the server until they get a technical person called in (seeing that this is a Sunday) so it does not display the "hacked" message.

You can see all sites by entering "ram.websitewelcome.com" here: http://www.myipneighbors.com/

[Sam]

I just went to see a website on that server and i get:

YouR WeB Is OwneD By
HACKERS PAL

[ ThE PaLesTiNiaN HaCkeR ]

YouR SeCuRiTy Is Too Weak .. Be CarEfuL NeXt TimE


GrEEtZ : DeviL-00 , MohAjali , J-HaCkeR , Dr.ExE , CraCk3R , WebCraCkeR , GaCkeR , Sp1deR_Net , Black AttaCk , MiniMan , JareeH BaghdaD , Dr Hacker , And Every One Of My Friends ..
Special GrEEtZ For : SoQoR.NeT TeaM AnD MemberS And Very Special One [T]o [ A ]

SeCuRiTy[AT]SoQoR[DoT]NeT
WwW[DoT]SoQoR[DoT]NeT

[El Hombre]

That's it, that is exactly what I got. So it is a complete server hack then?

I was told within the hour they would be back up and that was about 30 minutes back.

Sadly I have just completely revamped one of my joomla sites today and of course I did the back up before the changes, so I guess I will have to do it all again when we eventually get back unhacked sites.

[El Hombre]

So that's close on 600 sites on that server all hacked then, I am surprised that more people haven't been flooding the forum with this.

Has this happened before does anyone know?

[Sam]

Originally Posted by El Hombre

That's it, that is exactly what I got. So it is a complete server hack then?

I was told within the hour they would be back up and that was about 30 minutes back.

Sadly I have just completely revamped one of my joomla sites today and of course I did the back up before the changes, so I guess I will have to do it all again when we eventually get back unhacked sites.

Yup whole server has been done: http://www.myipneighbors.com/ put in 70.86.179.226 and look at all the websites on that server

[Sam]

Originally Posted by El Hombre

So that's close on 600 sites on that server all hacked then, I am surprised that more people haven't been flooding the forum with this.

Has this happened before does anyone know?

It's a reseller server, so a resellers clients wouldn't come here

EDIT: looks like accounts are getting restored

[El Hombre]

Not following you on that. Why wouldn't a resellers clients come here?
Surely if a reseller created an account/site for a client then this is where it would be?

[Sam]

Originally Posted by El Hombre

Not following you on that. Why wouldn't a resellers clients come here?
Surely if a reseller created an account for a client then this is where it would be?

Most resellers clients wouldn't know that their host was a reseller, so when the client sees their site is hacked they will contact the reseller

[El Hombre]

OK with you now, I thought you meant that their clients sites would not be affected?

I assume that any new accounts or sites created in the last 7 days will have to be recreated again now as they will be lost?

[NightRider]

I got

defaced by ka0x
D.O.M TEAM 2008

we are: ka0x, an0de, xarnuz

LAS GUERRAS QUE EMPRENDEN LOS PODEROSOS
SIEMPRE ACABAN MATБNDONOS A LOS DEMБS

[root@4runner /root]# uname -a;id;whoami
Linux 4runner.websitewelcome.com 2.6.22_hg_grsec_pax #45 SMP Thu Dec 6 03:29:19
CST 2007 i686 i686 i386 GNU/Linux
uid=0(root) gid=0(root) groups=33460(edmchile)
root
[root@4runner /root]#

POR LA LIBERTAD DE EXPRESIУN

greetz to SSH-2 [Byond Crew]

[ SPAIN - ARGENTINA ]

All of my 200 sites became with replaced index.html

[El Hombre]

That looks like a different hack than all the others on ram.websitewelcome.com is that your server as well or do we have enough server hacked here as well?????

[Sam]

Originally Posted by NightRider

I got



All of my 200 sites became with replaced index.html

4runner.websitewelcome got hacked aswell? i hope this isn't another cPanel exploit

[NightRider]

Another.... 74.53.25.146

[El Hombre]

http://www.myipneighbors.com

4runner.websitewelcome.com 613 sites mostly hacked

Any more out there????????????

[NightRider]

mostly hacked

they are all hacked

THE WARS undertaking THE POWERFUL
ALWAYS ACABAN MAT Б NDONOS TO DEM S Б

[NightRider]

Support suggested me

Hi,
Once you upload your own index.htm page, it will go away.
----------------------------------------------
Thank you for allowing me to help you.
Sincerely,
Ricardo
HostGator.com, LLC

Nice