Sentora Support Forums

Hi,

I think some sort of attack did this, suddenly my all sites, even control panel are redirecting to another site, I am not sure who did this and how, but i am unable to find any redirects in virtual host files, htaccess etc.

All of the sites are behaving the same way.  Some of the details are below.

Panel Domain: server2.afterdoor.com
Ip: 23.227.163.211
Ubuntu 14.04

Some of the hosted websites

afterdoor.com
mivapps.com

Everything is being redirected to another site.


Please help me out in this issue it's kind of urgent.

Thanks

(06-03-2019, 03:26 PM)damanmokha Wrote: [ -> ]Hi,

I think some sort of attack did this, suddenly my all sites, even control panel are redirecting to another site, I am not sure who did this and how, but i am unable to find any redirects in virtual host files, htaccess etc.

All of the sites are behaving the same way.  Some of the details are below.

Panel Domain: server2.afterdoor.com
Ip: 23.227.163.211
Ubuntu 14.04

Some of the hosted websites

afterdoor.com
mivapps.com

Everything is being redirected to another site.


Please help me out in this issue it's kind of urgent.

Thanks

You seem to have a script that has been added to your web pages at the very top, sometimes several times:



Is it possible for you to check if this has been added to the actual html files on your server or if it is being added dynamically somewhere?

You will know exactly what your server setup is, and the rest of us can only guess as to whether you have other people accessing your Sentora account, or other people accessing your server, and whether you are running a secure Sentora server of if you have tried upgrading PHP etc. which may have left a vulnerability. It's always possible that someone has found a way in that has been previously unknown, or it may be via a vulnerable script that you have on one of your sites... could be so many things but in a word I would describe it as some sort of "hack".

Keith

EDIT: If your signature is correct and you really are running Sentora 1.0.0, the current release is 1.0.3. Therefore you are incredibly out of date.

(06-03-2019, 03:26 PM)damanmokha Wrote: [ -> ]Hi,

I think some sort of attack did this, suddenly my all sites, even control panel are redirecting to another site, I am not sure who did this and how, but i am unable to find any redirects in virtual host files, htaccess etc.

All of the sites are behaving the same way.  Some of the details are below.

Panel Domain: server2.afterdoor.com
Ip: 23.227.163.211
Ubuntu 14.04

Some of the hosted websites

afterdoor.com
mivapps.com

Everything is being redirected to another site.


Please help me out in this issue it's kind of urgent.

Thanks

I tried accessing your panel (server2.afterdoor.com) which attempts to load theguardiantech.com with no success.

afterdoor.com seems to load includemylife.info
mivapps.com is correctly loaded.

Check again your panel and afterdoor.com vhosts.

Can you access the panel via local IP? If so:


Admin > Module Admin > Apache Config
 
Whats in your Global Sentora Entry ?
1) If the field is blank, enter a comment (adding a single # character into the text field) so we can update the VirtualHost entry.



2) Click Save Changes
3) Wait 5-10 minutes and check if your panel or other sites are loading properly in a private browsing window (to avoid loading a cached page).

You can calso Override a Virtual Host Setting for afterdoor.com on the Apache Config page.

If you are not able to access your panel investigate manually your vhost config files located at /etc/sentora/panel/configs/apache

First check httpd.conf and secondly check httpd-vhosts.conf

If your panel and afterdoor.com vhosts entries look good (you can send them to me if you like) try removing your htaccess and renaming and replacing the index file.

(06-03-2019, 03:26 PM)damanmokha Wrote: [ -> ]Hi,

I think some sort of attack did this, suddenly my all sites, even control panel are redirecting to another site, I am not sure who did this and how, but i am unable to find any redirects in virtual host files, htaccess etc.

All of the sites are behaving the same way.  Some of the details are below.

Panel Domain: server2.afterdoor.com
Ip: 23.227.163.211
Ubuntu 14.04

Some of the hosted websites

afterdoor.com
mivapps.com

Everything is being redirected to another site.


Please help me out in this issue it's kind of urgent.

Thanks

Looks like you got the problem sorted.

It would be good to know what you found and how it was being caused - in case it is something in Sentora that needs attention.

Keith.

I just checked it and it's redirecting. I suggest once you fix it, change your all your server access passwords.