Results 1 to 4 of 4

Thread: Website hacked?

  1. #1
    Senior Member
    Join Date
    Jul 2004
    Location
    London
    Posts
    2,456
    Thanks
    100
    Thanked
    75 times in 51 posts
    • Mblaster's system
      • Motherboard:
      • ASUS PK5 Premium
      • CPU:
      • Intel i5 2500K
      • Memory:
      • 8gb DDR3
      • Storage:
      • Intel X25 SSD + WD 2TB HDD
      • Graphics card(s):
      • Nvidia GeForce GTX 570
      • PSU:
      • Corsair HX520
      • Case:
      • Antec P180
      • Operating System:
      • Windows 7 Professional x64
      • Monitor(s):
      • HP w2207 (22" wide)
      • Internet:
      • Rubbish ADSL

    Website hacked?

    Don't worry, not talking about Hexus Another site I know of seems to be re-directing to random malware/scam websites when visiting it, but it only does this when you visit via a search engine, rather than typing in the web address into the browser bar.

    Wasn't sure this site was to blame at first, but I think it must be checking the referrer on the request to try and hide the fact that the site has been hacked, since it's going be pretty rare for a site owner to get to their site via a search engine they may not realise for a long time.

    The site owner is now aware, but thought I'd post here to check to see if this is something that's common, since I've never seen it before.
    I don't mean to sound cold, or cruel, or vicious, but I am so that's the way it comes out.

  2. #2
    Senior[ish] Member Singh400's Avatar
    Join Date
    Jun 2008
    Posts
    2,935
    Thanks
    136
    Thanked
    310 times in 247 posts

    Re: Website hacked?

    It's more likely that you have been infected with malware/spyware/adware/badware. Plenty of badware is known to re-direct search engine queries. I'd suggest you start scanning

  3. #3
    Senior Member
    Join Date
    Jul 2004
    Location
    London
    Posts
    2,456
    Thanks
    100
    Thanked
    75 times in 51 posts
    • Mblaster's system
      • Motherboard:
      • ASUS PK5 Premium
      • CPU:
      • Intel i5 2500K
      • Memory:
      • 8gb DDR3
      • Storage:
      • Intel X25 SSD + WD 2TB HDD
      • Graphics card(s):
      • Nvidia GeForce GTX 570
      • PSU:
      • Corsair HX520
      • Case:
      • Antec P180
      • Operating System:
      • Windows 7 Professional x64
      • Monitor(s):
      • HP w2207 (22" wide)
      • Internet:
      • Rubbish ADSL

    Re: Website hacked?

    It's not malware on my machine, since it's happening for multiple people in at least 3 different locations.

    Well, I got them to have a look at the web hosting, and turns out some edits had been made to the .htaccess file, something to do with a 'RewriteEngine'. Never heard of that before, but I can tell from the file that it was checking for a referrer of a search engine, then re-directing to a CGI script on a different (and obviously dodgy) site.

    The changes are now removed and it's back to normal, password on the hosting is changed also, so guess I'll wait and see what happens. I doubt it's caused by any malware infecting the server, since it's just web space at a hosting company, rather than running their own web server.
    I don't mean to sound cold, or cruel, or vicious, but I am so that's the way it comes out.

  4. #4
    Senior Member
    Join Date
    Feb 2008
    Posts
    925
    Thanks
    4
    Thanked
    161 times in 148 posts
    • smargh's system
      • Motherboard:
      • Gigabyte GA-EP45-UD3P
      • CPU:
      • Xeon E5450 with 775-to-771 Mod
      • Memory:
      • 16GB Crucial
      • Storage:
      • Intel X25-M G2 80GB/Adaptec 3405 4x 2TB Ultrastar RAID1 / 1x 6TB Hitachi He6 / Dying 2TB Samsung
      • Graphics card(s):
      • GTX 750 Ti
      • PSU:
      • Seasonic X-560
      • Case:
      • Lian-Li PC-A71
      • Operating System:
      • Windows 7 Ultimate 64bit
      • Monitor(s):
      • BenQ G2400WD
      • Internet:
      • Really Crap ADSL2 <3Mbit

    Re: Website hacked?

    This is common practice for spammers nowadays.

    Another thing you can spot on some sites is different pages for different user-agents - i.e. if it is presented with the Googlebot indexer, it will return the normal page with a massive amount of keyword spam. Then when normal people go to it via a Google search it will just serve the normal page plus the trojans/malware/adware/etc. For people visiting from either localhost, a local network, or with no referer, it will not modify the page at all so that the author doesn't get suspicious. They might only notice either when their Google Pagerank goes down due to Google noticing, or end users shouting at them.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. I have No faith with Scan's website
    By CD007 in forum SCAN.care@HEXUS
    Replies: 16
    Last Post: 10-04-2008, 07:30 PM
  2. riaa website hacked
    By j.o.s.h.1408 in forum General Discussion
    Replies: 6
    Last Post: 23-01-2008, 02:31 PM
  3. Israir website hacked
    By grizzla in forum General Discussion
    Replies: 0
    Last Post: 13-08-2006, 09:59 PM
  4. Website / Name Purchasing and Hosting (Help)
    By muddyfox470 in forum Software
    Replies: 8
    Last Post: 08-07-2005, 03:27 PM
  5. BBC culls Cult website
    By Steve in forum HEXUS News
    Replies: 0
    Last Post: 01-07-2005, 01:47 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •