Help! Domain spoofing...
 

I have a problem with a couple of domains. I lost contact with the host they were on and could no longer log in to ftp.

One of the domains, when I attempt to reach it, seems to load the correct page BUT with a virus! No virus on the other site's index page but it too has been obviously tampered with.

I pointed the domains to a new host and was shocked to find that they STILL load the same pages! With a little research I deduced that someone is "spoofing" my domains..

What I don't know is, how do I stop it?

Have you tried to scan your PC with antispyware. How about accessing the sites trough another computer?

Both. Anyone attempting to access these domains is directed undetectably to a duplicate site which is neither on my old host nor on my new one. altered to suit someone else's purposes.

Still stuck :(

Might changing registrars help?

Pretty much sounds near impossible, can you give the url's so we can investigate it for you? :2 cents:

Using a proxy server, I was able to reach the correct site.

I don't want to be responsible for the spread of a virus that appears to be coming from one of my websites...

Does this help?

Domain is redirecting to best-voyeur.info, which is the actual source of the virus (don't GO there unless
'you're a pro!)

It seems to be some sort of java applet/ infects the computer with iworm-bofra according to AVG.

Fake phone number, obviously..



Domain ID:D7816484-LRMS
Domain Name:BEST-VOYEUR.INFO
Created On:25-Oct-2004 14:39:24 UTC
Last Updated On:09-Dec-2004 13:08:11 UTC
Expiration Date:25-Oct-2005 14:39:24 UTC
Sponsoring Registrar:R136-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C7175719-LRMS
Registrant Name:Edward Lester
Registrant Street1:7338 Flamingo
Registrant City:Algonac
Registrant State/Province:MI
Registrant Postal Code:48001
Registrant Country:US
Registrant Phone:+1.10234567
Registrant *****************@yahoo.com

I just noticed this exact thing happening to one of my domains. It's redirecting to the same place. best-voyeur.info. Like Dagwolf DON'T GO THERE!!! It's not a virus on the end user, to me it looks like somebody hacked into the server and made the modifications to the index.htm. I just uploaded a backup index and the problem went away. This post started 4/12 anybody know anything more?

You might want to see what scripts you are running... if phpbb then it could be that.

The only script on the index is a banner js. I fixed the problem by just uploading a backup I had. That's why I think somebody got in there.

This is what I found in my index file.

These sites have that code as well(at least the few I checked)
http://www.google.com/search?hl=en&l...t-voyeur.info/