Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : HELP ! I think our server is under attack!

[filete]

Hey there!

I really need some help!
Some couple hours ago, I have notice that one of our subdomain
is not going where it should, but to some kind of proxy website:

Please check our subdomain:
server1.futureaudiostreams.com

and see if you know this page, footer says "Powered by glype",
I know that´s a free php script for proxy web surfing, but if I am
the only one with full root/admin control of the dedi server, how can
this is possible?

I got the felling the server is under attack,
what should I do to track it down, and how can its possible
someone be able to redirect one of the subdomain to some other place?!

Thanks

[PogiWeb]

Take a look at your A entry and make sure its pointing to the correct location.

[filete]

Yes, everything is correct (A entry, DNS zone).
The main domain goes to the right website,
but is that subdomain that started to be direct to that other page.

[AirJordansHead]

Hi, filete

I have visited the link in your post and I have not found what you said in your post.
If anything appears on your pages not adding by yourself, I think there might be a sql injection or hijacking.

[filete]

Originally Posted by AirJordansHead

Hi, filete

I have visited the link in your post and I have not found what you said in your post.
If anything appears on your pages not adding by yourself, I think there might be a sql injection or hijacking.

What do you mean you didn´t found what I said on my post?
Dont you get a website with this text and a form to enter a URL?:

"Welcome to futureaudiostreams where we guarantee you safe, fast and most importantly private browsing. Once you enter a web site and hit 'go' your browsing information and settings will be replaced with ours - keeping you safe from tracking software, trojans, virsues and spam. We value your privacy and don't store any record of your browsing on our server. At futureaudiostreams your browsing is truly personal as well as 100% safe and secure."

What is sql injection or hijacking all about?

Thanks again to all members that can help me trace
this strange issue!

[kemosabetx]

It loads and looks fine to me.

try using a Proxy Server to see what we see, Here is a list:
http://pleaseboycott.com/?page_id=9

Or use a different pc not on your ISP.

[filete]

Ok, I´ve been reading about sql injection and domain hijacking,
and I dont think is any of those.

Any more idea what can it be, and if its
really some kind of attack?

[filete]

Originally Posted by kemosabetx

It loads and looks fine to me.

try using a Proxy Server to see what we see, Here is a list:
http://pleaseboycott.com/?page_id=9

Or use a different pc not on your ISP.

If the page you are getting is what I mention before, then Its not our page!!
Is this difficult to understand?

We did not made that page, that page started to appear about 5 hours ago,
and I have no clue how can this be possible, have a subdomain attack when the
main domain from that sub-domain is still going to the right direction!

[filete]

*****UPDATE******

Ok, I did a DNS Server restart, and it solved the problem.
Now its going to the correct page.
I still think that this behave was very strange and looked some kind of attack.