Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a client that has a site which appears to have been hacked or something. I have the responsibility of trying to fix the issue.

www.[hatchachalink removed].com

Where would i look to fix the issue, in the htaccess of something

share|improve this question

migrated from stackoverflow.com Aug 23 '10 at 18:53

This question came from our site for professional and enthusiast programmers.

5  
Yeah, if you think I'm going to visit a web site "that appears to be hacked or something"... –  Paul Tomblin Aug 23 '10 at 18:25
1  
The other one percent of the time it's because the person complaining mispelt their own domain. –  Paul Tomblin Aug 23 '10 at 18:26
1  
Yeah, you should probably add to the question what exactly is wrong, so people have am idea of what they will get if they click the link. People don't want to be surprised. Particularly if they are browsing from work. –  Hammerite Aug 23 '10 at 18:30
1  
Does your client run a beijing escort service? They have many beautiful, fluent English girl. –  Pekka 웃 Aug 23 '10 at 18:32
3  
Nuke it from orbit, and restore the data. It is the only way to be sure. –  Zoredache Aug 23 '10 at 18:56

2 Answers 2

up vote 3 down vote accepted

The good news is that it doesn't seem to be the domain itself that got taken, the admin contact seems still to be your client:

Administrative Contact:
americaxl
Jesse Fisher ....

This is very good: You have no chance to forcibly get the domain back after it's been dropped and re-registered.

The site is sending a 301 Moved redirect to the Beijing escort site.

Seeing as the domain name still resolves to a Bluehost server 70.40.208.144, and assuming this is where your client runs his site, it doesn't look like the DNS settings have been hijacked: I would say the FTP or web hosting account has been hacked in some way and altered to send out the 301 redirect - either through a PHP script ("Header: Location...") or (that would be my gut feeling) through a setting in the hosting company's control panel.

The first step should be trying to log on to the FTP account and confirming whether that is the case.

share|improve this answer
    
I am logged into the Ftp what should i be looking for –  John Aug 23 '10 at 18:46
    
@John an index.php that does a header redirect to the beijing site. –  Pekka 웃 Aug 23 '10 at 18:47

The first thing I would do is use dig or host to see if the IP of the site is the correct IP. In this case, the IP belongs to "hostmonster.com". If that's not your web host, then somebody has hijacked your DNS. If it is, then the problem is either with hostmonster.com, or with your own setup on hostmonster.com.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.