My server was hacked..please help - GoFuckYourself.com

abshard · 11-27-2005, 04:44 PM

Im trying to find out what host is hosting this domain

********.COM

try a ping to ********.COM you get 127.0.0.1
try a ping to www.********.COM you get an ip but i have asked 5 people to ping the one with www and everyone is getting a different ip

http://www.whois.sc/********.com

shows this ip ********

i called that host they did nothing and the guy told me hes cant be hosted there because when he pings the domain he gets a different ip.

can anyone find out who hosts that domain??

bringer · 11-27-2005, 04:45 PM

is this a joke?

abshard · 11-27-2005, 04:46 PM

why do you say that?

Ice · 11-27-2005, 04:46 PM

domain: ********.com
owner: John Gerlach
email: [email protected]
address: 5424180288927848
city: Grosse Pointe Woods
state: --
postal-code: 48236
country: US
phone: +49 201 62589432
admin-c: [email protected]#0
tech-c: [email protected]#0
billing-c: [email protected]#0
nserver: ns3.free-dns-engine.com 65.19.154.30
nserver: ns4.free-dns-engine.com 66.36.229.178
status: lock
created: 2005-11-01 17:40:40 UTC
modified: 2005-11-01 17:50:20 UTC
expires: 2007-11-01 12:40:39 UTC
source: joker.com live whois service
query-time: 0.09852
db-updated: 2005-11-27 23:45:17

Current Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
IP Address: 127.0.0.1 (ARIN & RIPE IP search)
IP Location: -(-)
Lock Status: REGISTRAR-LOCK
DMOZ no listings
Y! Directory: see listings
Data as of: 14-Jun-2005

FrankWhite · 11-27-2005, 04:47 PM

ping www.********.COM
PING www.********.com (********): 56 data bytes
64 bytes from ********: icmp_seq=0 ttl=120 time=45.615 ms
64 bytes from ********: icmp_seq=1 ttl=120 time=71.180 ms
64 bytes from ********: icmp_seq=2 ttl=120 time=48.542 ms

abshard · 11-27-2005, 04:48 PM

The ip from whois.sc is a dialup/broadband host on the east coast...the guy on the phone didnt believe thye were hosting that domain after i gave them this url

http://www.whois.sc/********.com and it showed their ip as the host.

abshard · 11-27-2005, 04:48 PM

C:\Documents and Settings\Jason>ping www.********.com

Pinging www.********.com [********] with 32 bytes of data

Reply from ********: bytes=32 time=93ms TTL=110
Reply from ********: bytes=32 time=88ms TTL=110
Reply from ********: bytes=32 time=87ms TTL=110
Reply from ********: bytes=32 time=90ms TTL=110

abshard · 11-27-2005, 04:49 PM

someone else got ******** when they pinged the domain

bringer · 11-27-2005, 04:50 PM

ugh, noob central

Name: www.********.com
Addresses: ********

id contact your dns server admin

abshard · 11-27-2005, 04:50 PM

from my server i get

ping www.********.com
PING www.********.com (********) 56(84) bytes of data.
64 bytes from ********: icmp_seq=1 ttl=118 time=46.0 ms
64 bytes from ********: icmp_seq=2 ttl=118 time=158 ms

abshard · 11-27-2005, 04:51 PM

Quote:

Originally Posted by bringer

ugh, noob central

Name: www.********.com
Addresses: ********

id contact your dns server admin

So where is the guy hosted?

pornguy · 11-27-2005, 04:52 PM

What did the guy do. take yourdomain name or change the lnading page on your server?? And you should be on the phone with the hosting comapny. YOURS!

abshard · 11-27-2005, 04:53 PM

Used an exploit in a bbs script updated the UCJ on my server to run a binary file every 2 min

the updated ucj file is still on his server!

bringer · 11-27-2005, 04:53 PM

Quote:

Originally Posted by abshard

So where is the guy hosted?

its hosted on several hacked cable modems
probably more now thanks to this thread. enjoyed the virus it tried to install, thanks

abshard · 11-27-2005, 04:56 PM

So the ip address from http://www.whois.sc/********.com is not correct?

Deputy Chief Command · 11-27-2005, 04:56 PM

http://www.dnsstuff.com/tools/whois.ch?ip=********.com

AlienQ - BANNED FOR LIFE · 11-27-2005, 04:58 PM

127.0.0.1

Aint that like your home server or somthing as in a default for a local server on a network? Since when was it fun to "Spoof" yourself?

Sounds kinky.

abshard · 11-27-2005, 04:58 PM

Quote:

Originally Posted by Deputy Chief Command

http://www.dnsstuff.com/tools/whois.ch?ip=********.com

i dont think that whois info is correct for some reason hehe

abshard · 11-27-2005, 04:59 PM

the hacked ucj file he uploaded is still on that domain in a txt file

bringer · 11-27-2005, 05:00 PM

stop bumping the thread. its most likely a virus that hosts a fake tgp+virus and adds its ip to the pool. chances are its your site and you're using this thread to spread the virus. stfu already

AlienQ - BANNED FOR LIFE · 11-27-2005, 05:02 PM

Quote:

Originally Posted by bringer

stop bumping the thread. its most likely a virus that hosts a fake tgp+virus and adds its ip to the pool. chances are its your site and you're using this thread to spread the virus. stfu already

Yeah somthing weird with this thread, maybe he logging IP's for TGP submsissions that log IP's.
Newbies beware this could spell disaster for ya if ya do submssions.

11-27-2005, 04:44 PM	#1
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	My server was hacked..please help Im trying to find out what host is hosting this domain ******.COM try a ping to ****.COM you get 127.0.0.1 try a ping to www.****.COM you get an ip but i have asked 5 people to ping the one with www and everyone is getting a different ip http://www.whois.sc/****.com shows this ip ****** i called that host they did nothing and the guy told me hes cant be hosted there because when he pings the domain he gets a different ip. can anyone find out who hosts that domain?? Last edited by TexasDreams; 11-27-2005 at 05:09 PM..

11-27-2005, 04:45 PM	#2
bringer i have man boobies Join Date: Jul 2003 Location: van down by the river Posts: 13,082	is this a joke? __________________ 333-765-551

11-27-2005, 04:46 PM	#4
Ice Confirmed User Join Date: Nov 2002 Location: Sunny California Posts: 26,053	domain: *******.com owner: John Gerlach email: [email protected] address: 5424180288927848 city: Grosse Pointe Woods state: -- postal-code: 48236 country: US phone: +49 201 62589432 admin-c: [email protected]#0 tech-c: [email protected]#0 billing-c: [email protected]#0 nserver: ns3.free-dns-engine.com 65.19.154.30 nserver: ns4.free-dns-engine.com 66.36.229.178 status: lock created: 2005-11-01 17:40:40 UTC modified: 2005-11-01 17:50:20 UTC expires: 2007-11-01 12:40:39 UTC source: joker.com live whois service query-time: 0.09852 db-updated: 2005-11-27 23:45:17 Current Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM IP Address: 127.0.0.1 (ARIN & RIPE IP search) IP Location: -(-) Lock Status: REGISTRAR-LOCK DMOZ no listings Y! Directory: see listings Data as of: 14-Jun-2005 __________________ icq 1904905 Last edited by TexasDreams; 11-27-2005 at 05:09 PM..*

11-27-2005, 04:47 PM	#5
FrankWhite Confirmed User Join Date: Nov 2002 Location: nyc Posts: 3,540	ping www.******.COM PING www.****.com (****): 56 data bytes 64 bytes from ****: icmp_seq=0 ttl=120 time=45.615 ms 64 bytes from ****: icmp_seq=1 ttl=120 time=71.180 ms 64 bytes from *****: icmp_seq=2 ttl=120 time=48.542 ms Last edited by TexasDreams; 11-27-2005 at 05:17 PM..*

11-27-2005, 04:48 PM	#6
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	The ip from whois.sc is a dialup/broadband host on the east coast...the guy on the phone didnt believe thye were hosting that domain after i gave them this url http://www.whois.sc/*******.com and it showed their ip as the host. Last edited by TexasDreams; 11-27-2005 at 05:10 PM..*

11-27-2005, 04:49 PM	#8
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	someone else got ******** when they pinged the domain Last edited by TexasDreams; 11-27-2005 at 05:12 PM..

11-27-2005, 04:50 PM	#9
bringer i have man boobies Join Date: Jul 2003 Location: van down by the river Posts: 13,082	ugh, noob central Name: www.******.com Addresses: ****** id contact your dns server admin __________________ 333-765-551 Last edited by TexasDreams; 11-27-2005 at 05:12 PM..

11-27-2005, 04:52 PM	#12
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	What did the guy do. take yourdomain name or change the lnading page on your server?? And you should be on the phone with the hosting comapny. YOURS! __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

11-27-2005, 04:53 PM	#13
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	Used an exploit in a bbs script updated the UCJ on my server to run a binary file every 2 min the updated ucj file is still on his server!

11-27-2005, 04:56 PM	#15
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	So the ip address from http://www.whois.sc/*******.com is not correct? Last edited by TexasDreams; 11-27-2005 at 05:14 PM..*

11-27-2005, 04:56 PM	#16
Deputy Chief Command Deputy Chief Command Industry Role: Join Date: Nov 2005 Posts: 4,482	http://www.dnsstuff.com/tools/whois.ch?ip=*******.com Last edited by TexasDreams; 11-27-2005 at 05:14 PM..*

11-27-2005, 04:58 PM	#17
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	127.0.0.1 Aint that like your home server or somthing as in a default for a local server on a network? Since when was it fun to "Spoof" yourself? Sounds kinky. __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \|

11-27-2005, 04:59 PM	#19
abshard Confirmed User Industry Role: Join Date: Jan 2002 Location: AZ Posts: 6,446	the hacked ucj file he uploaded is still on that domain in a txt file

11-27-2005, 05:00 PM	#20
bringer i have man boobies Join Date: Jul 2003 Location: van down by the river Posts: 13,082	stop bumping the thread. its most likely a virus that hosts a fake tgp+virus and adds its ip to the pool. chances are its your site and you're using this thread to spread the virus. stfu already __________________ 333-765-551