Le site idealhosting.net.tr est-il sûr ?

Switch off JScript on this site! (Blackhat hoster) Many attacks are driven from the ip range ***** trying to infect servers. The broken systems are used by criminals for rogue online pharmacies and several other spam attacks (Canadian Health&Care, Online Casinos, ***** fakes and many others). Fraud out of UK, NL, TR, RU. They belong together with: 146.0.73.155, 146.0.73.156, 146.0.73.170, 146.0.74.28, 146.0.74.170, 146.0.74.202, 146.0.74.204, 146.0.74.206, 146.0.74.208, 146.0.74.212, 146.0.74.234, ***** 5.39.219.27,5.39.219.25,5.39.218.37 Hosts mostly resolve only to their reverse address. If you find visitors on your joomla server from this range scan your joomla server for com_user/views/reset/tmpl/index.php, component/user/reset.html at any location mod.php, ll.php, pp.php, p.php, ttt.php, dkml.php, pp1.php, muakero.php, mua.php, 0day.gif, add.gif, ddxdx.gif, dxx.gif, hrd.gif,susu*.gif, movie.gif, ttt.gif, mua.gif, llp.gif (the gif's can have a php extention instead gif and will be mostly in images/stories/) and php-files containing the words: "vpsp_version" (vpsadmin.idealhosting.net.tr look for similar vpsadmin's), "isko", "iskorpitix" (http://mavi1.org ~ receiver for encoded php scripts to receive all security relevant information from the site (passwd etc.), "case 'execute'", "Shell Gonderilmeye Musait", "'Execute command on server'", additionally scan your images for carrying php code. Unless they belong to your joomla installation, they might be fraudulent. History: In your log files you may find the initial abuse about 1/2 year earlier something like pp.php (any of the above mentioned files) might occur. After that they have a client (similar to an ftp client) with full access to the web space and all underlaying directories which the server allowes. This means they have the configuration.php and all your passwords within to the ftp/sql server and ... 2-3 months later they "extend" their access with several php files in several directories (testing where they can call it from a browser - watch your search history) from 208.115.111.75, 188.40.162.51, 94.228.220.68, 85.107.236.117, ***** (TR bridge to RU, see next),188.92.78.124 (ADTECHNOLOGY-LV-NET), ***** (ezooms.bot @ gmail.com), 122.164.151.152, 5.104.105.41, 94.242.237.110, *****, ***** Finally takes control on Mar, 19th 13 ff: 95.5.76.227, 95.5.102.8, 94.153.9.119, ***** (both from Ukraine), 94.242.237.110, 94.242.237.115 (fxplm.com, LU-ROOT-20081021 reg at Moniker), 94.242.237.63, 94.242.237.73, 94.242.237.101, 94.242.237.110, 94.242.237.111, 94.242.237.115, ***** 94.242.237.122, 94.242.237.124, 94.242.237.126, 94.242.237.127, 94.242.237.128, ***** It ends up with the hosts on top, they are still active at the time of writing. The actions from these scripts are not within your logs, sometimes you may find entries in the error_log if things do not work as they expect. The adtech hacker makes less errors than the turkish one. The "productive" cycle starts with (vpsp!). They have now the ability to introduce new users/change existing users in the sql base and start to infect your articles with their "content" where your content is mostly used as forwarder. They will havrest your and your users email addresses. This is the latest point to get your content off the web, i.e. disabling the webspace, cause from now on your website will be spamvertised. You may find more spam on your spamtrap addresses if you have built in some fake email addresses for this purpose. After taking the site down and if you are the only administrator watch your logs for com_login within /administrator/ to identify the abusers. You will have to change all your passwords for the webserver (sql/ftp and user) before you start redoing your webspace. read on ***** and *****