deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
Just after a bit of reassurance before I get to work tomorrow and start picking up the phone! 
 
Our work website got hacked early hours of this morning and was replaced with a strange Turkish holding page. I'm no techy and have no understanding of what they did, but the issue got sorted. 
 
The company that we pay to do our hosting got it up and running again so all was fine. 
 
I get home to do some content work and the website is down again, with every URL redirecting to "/cgi-sys/suspendedpage.cgi". 
 
Website in question: http://www.sec-online.co.uk 
 
Where is the issue laying now? Has the site been hacked again or is the hosting company not liking what happened so suspended it? 
 
Any info would be great! 
 
 
 | 
Dom 
Member 
 
Registered: 13th Sep 03
 
User status: Offline 
 
 | 
 
I would say the host, webfusion.co.uk, have suspended the account. Get onto your web dev company and get them to chase it up with them unless you have direct dealings with webfusion.
 | 
deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
  
 
So Webfusion would have suspended it because of the dodgey activity earlier today?
 | 
deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
Hmmm, now have the following message: 
 
code: Forbidden 
 
You don't have permission to access / on this server. 
 
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.
    
 | 
Rob_Quads 
Member 
 
Registered: 29th Mar 01
 Location: southampton 
User status: Offline 
 
 | 
 
did you change all the password etc. If they didn't it was probably just rehacked and then screwed up again. 
 
You should be able to get the webhost to reset the account, reset all passwords and then restore the website from a known point in time (if they provide backups for your package)
 | 
deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
 
 | 
deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
All sorted now. All issues layed with host rather than Webfusion who only host the domain. 
 
So who checked at work and works for a US based company? 
 
We use Lead Forensics which tracks fixed IPs and gives company information. 
 
 
Jacobs Engineering Group Inc 
Oak Ridge (TN), United States 
www.jacobs.com 
865 220 4800 
Total Website visits: 1 
Date/Time: Oct 30 2013 12:42PM 
Duration: Bounced 
Webpage: Link - http://c20xe.co.uk/board/viewthread.php?tid=660252 (http://www.sec-online.co.uk/) 
 
  
 | 
Dom 
Member 
 
Registered: 13th Sep 03
 
User status: Offline 
 
 | 
 
quote: Originally posted by deano87 
All sorted now. All issues layed with host rather than Webfusion who only host the domain.
   
 
Hosteurope.de your host then? Did they suspend the account due to the hack?
 | 
deano87 
Member 
 
Registered: 21st Oct 06
 Location: Bedfordshire Drives: Ford Fiesta 
User status: Offline 
 
 | 
 
I must admit I thought it was Rackspace. 
 
Site needs redeveloping anyway as it was built badly and still on Joomla 1.5 so having major issues.
 |