I was hacked!!!

[topmafia]

I dont know how or why but i was hacked dont goto my website topmafia the ip that i caught on my account was from the uk and thats weird because im from the us.

Spoiler: Ip address

90.213.1.116

any help would be appreciated

 

[bdistler]

I am sure @Livewire will be in here to give you some 'inside' help
###

...the ip that i caught on my account was from the uk

was that "on" or "inside" your account - they are not the same
###

...thats weird because im from the us.

why do you think that is "weird" ? - any Web site (IP) in the world can attack any Web site (IP) in the world

 

[topmafia]

That was the last ip to login to my account. and i was just letting you know that its weird that i had a uk ip on my account. and hes getting into all of my accounts

 

[Livewire]

If you suspect you've been compromised and they were able to login to cPanel, this would indicate a password compromise; as such I would strongly recommend changing your password through the account panel, and then begin working to clean up any damage that has been done.

 

[topmafia]

the problem is he/she deleted everything

 

[Livewire]

I'm checking with admins but normally we don't have the ability to restore deleted files, even if it's from a compromise. The backup type we normally keep would mean rolling the entire server back, which wouldn't be feasible both due to the amount of data and other users who's data would suddenly be rolled to older versions.

The best I can advise for now is if you have backups, you should restore from those. If not, you may end up having to start over; with any luck the rogue didn't erase your MySQL data, but if they did you may have to start 100% from scratch. This is part of why the Terms of Service details that backups are the sole responsibility of the customer; it may seem harsh but no service is free from failure or hack-proof, so the webmaster should always have their own backup for emergencies that require it (even if we have backups, it's usually faster to self-restore).

 

[Livewire]

I've confirmed with admins that our current server setup actually doesn't have backups available for right now. Knowing this, if you don't have backups, the data is lost and you'd need to rebuild with whatever's left (with any luck the MySQL data's intact, but I'd check that over first to ensure it hasn't been damaged too).