Hacked last night

[localrich]

First off I DO NOT think they got in via WHMCS, but WHMCS was the target.

 

These two IP's did the dirty work

61.5.46.167

125.160.192.154

cc.order@live.com

 

They changed one of the administartor passwords and added their gmail account it. They then created a new client and ordered 18 nodes of VPS services. Somehow they also requested the password for a client with a different email address than what is in the system. My guess is they gained MYSQL access through an outdated Joomla install on one of the subdomains we run

 

Luckily they goofed the password on the admin so I got the notice and was able to get their IP's blocked at the firewall update Joomla reset the users and admin password before they got much further. They persisted to try and get back in for 3 hours after they were blocked.

[easyhosting]

First off I DO NOT think they got in via WHMCS, but WHMCS was the target.

 

These two IP's did the dirty work

61.5.46.167

125.160.192.154

cc.order@live.com

 

They changed one of the administartor passwords and added their gmail account it. They then created a new client and ordered 18 nodes of VPS services. Somehow they also requested the password for a client with a different email address than what is in the system. My guess is they gained MYSQL access through an outdated Joomla install on one of the subdomains we run

 

Luckily they goofed the password on the admin so I got the notice and was able to get their IP's blocked at the firewall update Joomla reset the users and admin password before they got much further. They persisted to try and get back in for 3 hours after they were blocked.

 

If you still have the logs of their hack then report the IPs

 

61.5.46.167 report to abuse@telkom.net.id

http://whois.domaintools.com/61.5.46.167

 

125.160.192.154 report to abuse@telkom.net.id

http://whois.domaintools.com/125.160.192.154

[localrich]

If you still have the logs of their hack then report the IPs

 

61.5.46.167 report to abuse@telkom.net.id

http://whois.domaintools.com/61.5.46.167

 

125.160.192.154 report to abuse@telkom.net.id

http://whois.domaintools.com/125.160.192.154

 

I did report them, but the email bounced.

[B r a n d o n]

Why are you hosting clients on the same server your support portal is on?

[localrich]

Why are you hosting clients on the same server your support portal is on?

 

It's on of OUR SUB domains thankfully the clients are all on different servers.

[hastehosting]

id report them to the abuse at their isp.

if you use cPanel ,Password protect your admin dir. this way you need 2 passwords to get into the admin panel!

[easyhosting]

id report them to the abuse at their isp.

if you use cPanel ,Password protect your admin dir. this way you need 2 passwords to get into the admin panel!

 

i already gave the links and the abuse emails for both the IPs

[panacheweb]

what I do when I need subdomains for my hosting account such as my blog.. I make a new cpanel account that way I have security on my accounts.

 

for example blog.domain.com, secure.domain.com, and http://www.domain.com would be 3 seperate cpanel accounts using the one domain..

 

that way if you have an outdated joomla install.. like this you can just suspend the account yourself or gain control of it with an update and so forth.