My server was hacked..please help

**bringer** · 11-27-2005, 02:45 PM

is this a joke?

**abshard** · 11-27-2005, 02:46 PM

why do you say that?

**Ice** · 11-27-2005, 02:46 PM

domain: ********.com
owner: John Gerlach
email: [email protected]
address: 5424180288927848
city: Grosse Pointe Woods
state: --
postal-code: 48236
country: US
phone: +49 201 62589432
admin-c: [email protected]#0
tech-c: [email protected]#0
billing-c: [email protected]#0
nserver: ns3.free-dns-engine.com 65.19.154.30
nserver: ns4.free-dns-engine.com 66.36.229.178
status: lock
created: 2005-11-01 17:40:40 UTC
modified: 2005-11-01 17:50:20 UTC
expires: 2007-11-01 12:40:39 UTC
source: joker.com live whois service
query-time: 0.09852
db-updated: 2005-11-27 23:45:17

Current Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
IP Address: 127.0.0.1 (ARIN & RIPE IP search)
IP Location: -(-)
Lock Status: REGISTRAR-LOCK
DMOZ no listings
Y! Directory: see listings
Data as of: 14-Jun-2005

**FrankWhite** · 11-27-2005, 02:47 PM

ping www.********.COM
PING www.********.com (********): 56 data bytes
64 bytes from ********: icmp_seq=0 ttl=120 time=45.615 ms
64 bytes from ********: icmp_seq=1 ttl=120 time=71.180 ms
64 bytes from ********: icmp_seq=2 ttl=120 time=48.542 ms

**abshard** · 11-27-2005, 02:48 PM

The ip from whois.sc is a dialup/broadband host on the east coast...the guy on the phone didnt believe thye were hosting that domain after i gave them this url

http://www.whois.sc/********.com and it showed their ip as the host.

**abshard** · 11-27-2005, 02:48 PM

C:\Documents and Settings\Jason>ping www.********.com

Pinging www.********.com [********] with 32 bytes of data

Reply from ********: bytes=32 time=93ms TTL=110
Reply from ********: bytes=32 time=88ms TTL=110
Reply from ********: bytes=32 time=87ms TTL=110
Reply from ********: bytes=32 time=90ms TTL=110

**abshard** · 11-27-2005, 02:49 PM

someone else got ******** when they pinged the domain

**bringer** · 11-27-2005, 02:50 PM

ugh, noob central

Name: www.********.com
Addresses: ********

id contact your dns server admin

**abshard** · 11-27-2005, 02:50 PM

from my server i get

ping www.********.com
PING www.********.com (********) 56(84) bytes of data.
64 bytes from ********: icmp_seq=1 ttl=118 time=46.0 ms
64 bytes from ********: icmp_seq=2 ttl=118 time=158 ms

**abshard** · 11-27-2005, 02:51 PM

Originally posted by bringer

ugh, noob central

Name: www.********.com
Addresses: ********

id contact your dns server admin

So where is the guy hosted?

**pornguy** · 11-27-2005, 02:52 PM

What did the guy do. take yourdomain name or change the lnading page on your server?? And you should be on the phone with the hosting comapny. YOURS!

**abshard** · 11-27-2005, 02:53 PM

Used an exploit in a bbs script updated the UCJ on my server to run a binary file every 2 min

the updated ucj file is still on his server!

**bringer** · 11-27-2005, 02:53 PM

Originally posted by abshard

So where is the guy hosted?

its hosted on several hacked cable modems
probably more now thanks to this thread. enjoyed the virus it tried to install, thanks

**abshard** · 11-27-2005, 02:56 PM

So the ip address from http://www.whois.sc/********.com is not correct?

**Deputy Chief Command** · 11-27-2005, 02:56 PM

http://www.dnsstuff.com/tools/whois.ch?ip=********.com

**AlienQ - BANNED FOR LIFE** · 11-27-2005, 02:58 PM

127.0.0.1

Aint that like your home server or somthing as in a default for a local server on a network? Since when was it fun to "Spoof" yourself?

Sounds kinky.

**abshard** · 11-27-2005, 02:58 PM

Originally posted by Deputy Chief Command

http://www.dnsstuff.com/tools/whois.ch?ip=********.com

i dont think that whois info is correct for some reason hehe

**abshard** · 11-27-2005, 02:59 PM

the hacked ucj file he uploaded is still on that domain in a txt file

**bringer** · 11-27-2005, 03:00 PM

stop bumping the thread. its most likely a virus that hosts a fake tgp+virus and adds its ip to the pool. chances are its your site and you're using this thread to spread the virus. stfu already

**AlienQ - BANNED FOR LIFE** · 11-27-2005, 03:02 PM

Originally posted by bringer

stop bumping the thread. its most likely a virus that hosts a fake tgp+virus and adds its ip to the pool. chances are its your site and you're using this thread to spread the virus. stfu already

Yeah somthing weird with this thread, maybe he logging IP's for TGP submsissions that log IP's.
Newbies beware this could spell disaster for ya if ya do submssions.

My server was hacked..please help

My server was hacked..please help

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment