Resolved Is x13 down?

Status
Not open for further replies.

femifitx

Member
Messages
120
Reaction score
2
Points
18
My site is inaccessible and I'm unable to get into cpanel after successfully logging in. I've tried different browsers, same result. I get the following message after successfully logging in (see attached image).
 

Attachments

  • Screen Shot 2020-08-28 at 12.33.51 PM.png
    Screen Shot 2020-08-28 at 12.33.51 PM.png
    53.8 KB · Views: 7

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
Sounds like you could be IP blocked. Can you visit your site or is that also down?
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
It sounds like your IP address is blocked. This happens usually with a few bad login attempts in a short time. Generally, it will clear itself, but I will have an admin look into it.

If you use a different network, like a cell phone using data or someone else's computer, you will probably see it works.

Please be advised that using software to hide or disguise your IP address can result in additional blocks, so please don't use these.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
I just tried using my phone on data and I'm still unable to get to my site. It looks like there's some kind of redirect script.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
I'm able to log in but can't get to cpanel (Direct Admin). I can't even get to my files and database to see if I've been compromised somehow.
 

Attachments

  • Screen Shot 2020-08-28 at 4.57.21 PM.png
    Screen Shot 2020-08-28 at 4.57.21 PM.png
    92.5 KB · Views: 3

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
Yes, your account does appear to be compromised. It looks like two separate issues though.

I'm going to suspend your account to take it offline. Once an admin unblocks your IP, they can let you back in. You will have to delete everything that may have been compromised.
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
It happens quite a lot. Make sure you change your passwords for x10 and for everywhere else, just in case. It's probably a weakness in your software that let someone upload their own files, but it's hard to tell.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
Thanks.
This just makes me so sad. I don't understand why anyone would want to attack my site - and I recently just changed my passwords too to prevent this.
Oh well...
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
It's usually an automated bot that looks for a certain file on your website. If that file exists, it knows how to trick your software into letting it do things like run commands or upload files. Once it can do that, it takes over your whole website and tries to trick your users.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
Hoping an Admin gets to this quickly. That "suspension" notice on my domain is not good at all. It's really, really bad for my brand.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
Checking through my phone (data), it just shows up as "apache is functioning normally".
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
I changed the link in an edit; maybe you clicked it before the edit.

https://x13.x10hosting.com:2222

If you can see the link even without the 2222, you're good. I'll unblock you.

Please delete EVERYTHING in the folder ~/domains/[your site here]/public_html. Every file has the potential of being infected with something malicious. Also delete any databases that were associated with your software. We can get a restoration from March, possibly, but anything as it exists now should be treated as infected.
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
Unless you can FTP from your phone, that's probably not going to work if you are indeed blocked. If you aren't, then you'll be fine. Just don't keep logging in over and over again if you get an error because that's what gets you blocked.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
Ah, you're right. No, can't FTP from phone. Doesn't look like I can do much until the IP gets unblocked.
 

garrettroyce

Community Support
Community Support
Messages
5,609
Reaction score
250
Points
63
Log in to DirectAdmin and rename ~/domains/[your domain name]
Create the folder that you just renamed.
 

femifitx

Member
Messages
120
Reaction score
2
Points
18
Thanks. Just did. I'm going to create a "site under maintenance" page there till IP gets fixed.
Thank you.
 
Status
Not open for further replies.
Top