Resolved Is x13 down?

[femifitx]

My site is inaccessible and I'm unable to get into cpanel after successfully logging in. I've tried different browsers, same result. I get the following message after successfully logging in (see attached image).

 

[garrettroyce]

Sounds like you could be IP blocked. Can you visit your site or is that also down?

 

[femifitx]

IP blocked?
No, I can't get to my site either.

 

[garrettroyce]

It sounds like your IP address is blocked. This happens usually with a few bad login attempts in a short time. Generally, it will clear itself, but I will have an admin look into it.

If you use a different network, like a cell phone using data or someone else's computer, you will probably see it works.

Please be advised that using software to hide or disguise your IP address can result in additional blocks, so please don't use these.

 

[femifitx]

I just tried using my phone on data and I'm still unable to get to my site. It looks like there's some kind of redirect script.

 

[femifitx]

I'm able to log in but can't get to cpanel (Direct Admin). I can't even get to my files and database to see if I've been compromised somehow.

 

[garrettroyce]

Yes, your account does appear to be compromised. It looks like two separate issues though.

I'm going to suspend your account to take it offline. Once an admin unblocks your IP, they can let you back in. You will have to delete everything that may have been compromised.

 

[femifitx]

OMG!

 

[garrettroyce]

It happens quite a lot. Make sure you change your passwords for x10 and for everywhere else, just in case. It's probably a weakness in your software that let someone upload their own files, but it's hard to tell.

 

[femifitx]

Thanks.
This just makes me so sad. I don't understand why anyone would want to attack my site - and I recently just changed my passwords too to prevent this.
Oh well...

 

[garrettroyce]

It's usually an automated bot that looks for a certain file on your website. If that file exists, it knows how to trick your software into letting it do things like run commands or upload files. Once it can do that, it takes over your whole website and tries to trick your users.

 

[femifitx]

Hoping an Admin gets to this quickly. That "suspension" notice on my domain is not good at all. It's really, really bad for my brand.

 

[garrettroyce]

If you can see https://x13.x10hosting.com:2222 I will un-suspend you. If you're still unable, I'd rather not have a live malicious site and you wouldn't want your users there either.

 

[femifitx]

Checking through my phone (data), it just shows up as "apache is functioning normally".

 

[garrettroyce]

I changed the link in an edit; maybe you clicked it before the edit.

https://x13.x10hosting.com:2222

If you can see the link even without the 2222, you're good. I'll unblock you.

Please delete EVERYTHING in the folder ~/domains/[your site here]/public_html. Every file has the potential of being infected with something malicious. Also delete any databases that were associated with your software. We can get a restoration from March, possibly, but anything as it exists now should be treated as infected.

 

[femifitx]

Okay, thanks. I'll try and FTP in now to get to the files first.

 

[garrettroyce]

Unless you can FTP from your phone, that's probably not going to work if you are indeed blocked. If you aren't, then you'll be fine. Just don't keep logging in over and over again if you get an error because that's what gets you blocked.

 

[femifitx]

Ah, you're right. No, can't FTP from phone. Doesn't look like I can do much until the IP gets unblocked.

 

[garrettroyce]

Log in to DirectAdmin and rename ~/domains/[your domain name]
Create the folder that you just renamed.

 

[femifitx]

Thanks. Just did. I'm going to create a "site under maintenance" page there till IP gets fixed.
Thank you.