My site has been hacked!

[autolink]

I just found my site, however it was not at my normal URL. I later found out that my site was hacked! The hackers broke into my account deleted my site and all my pictures. I was in the process of redeveloping my site so I didn't have a back-up of it. Before they deleted they did manage to mirror my site. Now customers are cuying items from my mirror site. Not only do they get ripped out of their money, my name is being ruined! I don't know what to do I have already changed all my passwords and renamed all my pictures because those were corrupted thanks to the hackers. But now I am completly lost and don't know what to do. Should I rebuild my site, then risk loseing it again. But for now I am just waiting. I need to do something because I am losing money every day now. Any suggestions on what to do would be greatfull!

[ldyguique]

A. When I click on your URL -- it takes me to the freeservers.com index page and says: Site available.
The subdomain disneywebdesign.com is available. Use the link on the right to sign up for your FREE Web site.

B. Yet, a whois lookup shows:
Name Server: NS3.FREESERVERS.COM NS4.FREESERVERS.COM
ICANN Registrar: WILD WEST DOMAINS, INC.
Created: 26-jul-2003
Expires: 26-jul-2004
Status: ACTIVE

Registrant:
Autolink

Registered through: VoxDomains.com
Domain Name: DISNEYWEBDESIGN.COM

Domain servers in listed order:
NS3.FREESERVERS.COM
NS4.FREESERVERS.COM

C. I see that voxdomains.com = proxy that screens actual whois info

D. freeserver.com is showing as inactive for website in the whois

E. Since there is no website (mirrored or otherwise) that comes up for your URL, not even an under construction page; and, freeserver claims that the domain is available. Plus, you've chosen for a domain name a very well-known and trademarked name. Something is not adding up right.

This is more than hacking and you've not given all of the facts.

[minstrel]

Something is not adding up right. This is more than hacking and you've not given all of the facts.

Or more likely it has nothing to do with hacking at all - just another lame attempt at trying to sneak spam into these forums... frankly, apart from their persistence, one of the things that's so annoying about spammers is that "dumb and dumber" aspect.

Nice research, ldyguique.

And if we've misjudged you, autolink, I apologize - but I doubt that will be required.

[carju1]

Just in case some of you don't know. When a MOD sees a post that is slightly suspicious we either delete it (OK OK I delete 'em) or we post a link in the MOD forum and ask the other Mods for advice.

For the one above I screamed for advice and I thought I share one of the other MODS (no names no pack drill) response.

It seems to me it's a tossup between leaving it there as a demonstration that WPW members are not nearly as dumb as the spammers, or deleting it because you feel that not to do so rewards the spammer.

So I'll leave the post and either autolink can explain exactly what's going on or we can have this as a nice record of smart members.

Julian

[rocky1]

Excellent call on the Mods part, Julian! I think we should have a few left up as examples as well.

I too would like to commend ldyguique on the research on this one. I wanted to scream "YOU GO GIRL!", this morning, but I was trying to wrap up research on a request received from wclew in PM and get out of here to go shopping for my kids, and simply didn't get around too it! Outstanding research talents, and the tenacity to call a spade a spade when you see it; I see MVP status written all over your posts someday!

Oh yes, and from your Jewish mother, we all love the picture darlin! };^)

[janeth]

I agree it looks bad when someone comes only to lie and try and trick people.

Thanks ldyguique

[matauri]

I may be way off base here, but I think yas are being a bit harsh. Been reading a few old posts & did some checking msyelf.

Autolinks, correct me if I am wrong, but your site is http://www.autolink.4t.com/main.html ? And its hosted by feeservers? And Disney Web Designs is an offshoot (a subdomain?) of this? (tho I couldnt get any reg. info on it, it apears to be a taken domain name, but site comes up as unavailable)
Link to it is from here - http://www.autolink.4t.com/contact.html

You have also logged in before as autosignals ? And your http://www.autosignals.com/ is under construction?

I kind of figured that you have a domain name, but are still using free hosting?

If by all of the above I am right, which has been hijacked? The http://www.autolink.4t.com/main.html or the http://www.autosignals.com/ ?


Cindy

[rocky1]

Hmmmm! You know, I always have to wonder why someone would want more than one alias on a forum of this nature. What might they be trying to cover up in posing as several different people? The problem is they seem to forget that they leave trails here that all point back to one individual, and sooner or later someone finds cause to investigate those trails.

Please enlighten us Autolink, or Autosignals, or Autowhoeveryouarethisweek!

[matauri]

Rocky...put those claws back in! He could have just decided to change his account, lost a password, etc, etc. In my less experienced days I did the same.

I would hate to go to trail with you guys. I would be hung b4 my trial.

All I am saying is, if he wanted to spam, why has he been asking for help b4 & not spamming b4? We'll prob never know, coz he prob wont come back again after this thread.

You can call me naive, but, I am giving this guy the benefit of doubt.


Cindy

[minstrel]

Cindy:

I think a willingness to assume honest mistake rather than malice is a good approach at any time and, as I said in my earlier reply to this thread, it is possible we're misjudging this person. On the other hand, he didn't just change his ID, he changed his URL too - and that URL takes you to a site that basically asks you if you want to buy a domain name.

So yes - maybe this is a genuine post and maybe we're all overly suspicious. If so, autolink, I do encourage you to come back and clear this up...