2013-01-25, 06:05 AM
Still happening. It's very possible the host is hacked, but it is a black eye on the hosting service to not have been noticed any sooner than this. Either way you shouldn't have to fix it. Just open a support ticket. If it doesn't get fixed find a better host.
Request URL:https://www.swordofmoonlight.com/
Request Method:GET
Status Code:302 Found
Request Headersview source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Connection:keep-alive
Cookie:SMFCookie304=a%3A4%3A%7Bi%3A0%3Bs%3A2%3A%2219%22%3Bi%3A1%3Bs%3A40%3A%22f91af15fffb6be63e12e613b62867f9a6fa5bf77%22%3Bi%3A2%3Bi%3A1452443720%3Bi%3A3%3Bi%3A0%3B%7D; __utma=15287220.894236322.1257141082.1312101578.1315202564.93; PHPSESSID=9cb4d09915f5ba314899a6afaa761a19; tapatalk_redirect3=false
Host:www.swordofmoonlight.com
Referer:\<span> site blocked, contact your administrator/
User-Agent:Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11
Response Headersview source
Cache-Control:private, must-revalidate, max-age=0
Connection:close
Content-Encoding:gzip
Content-Length:208
Content-Type:text/html; charset=iso-8859-1
Date:Fri, 25 Jan 2013 04:53:14 GMT
Location:https://rarechristianbooks.com/omwi.html?h=1222197
Server:Nginx / Varnish
Vary:Accept-Encoding
See if Referer:\<span> site blocked, contact your administrator/ said som.com or was empty then the link would work. Otherwise it gets redirected. That's just the logic of the hack so that it is more likely to go unnoticed.
It doesn't look like any scripting is involved. If an application was involved it seems like your website would not be targeted specially unless there is something about your host that makes it vulnerable, but an application could do all of this without ever connecting to your host.
Request URL:https://www.swordofmoonlight.com/
Request Method:GET
Status Code:302 Found
Request Headersview source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Connection:keep-alive
Cookie:SMFCookie304=a%3A4%3A%7Bi%3A0%3Bs%3A2%3A%2219%22%3Bi%3A1%3Bs%3A40%3A%22f91af15fffb6be63e12e613b62867f9a6fa5bf77%22%3Bi%3A2%3Bi%3A1452443720%3Bi%3A3%3Bi%3A0%3B%7D; __utma=15287220.894236322.1257141082.1312101578.1315202564.93; PHPSESSID=9cb4d09915f5ba314899a6afaa761a19; tapatalk_redirect3=false
Host:www.swordofmoonlight.com
Referer:\<span> site blocked, contact your administrator/
User-Agent:Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11
Response Headersview source
Cache-Control:private, must-revalidate, max-age=0
Connection:close
Content-Encoding:gzip
Content-Length:208
Content-Type:text/html; charset=iso-8859-1
Date:Fri, 25 Jan 2013 04:53:14 GMT
Location:https://rarechristianbooks.com/omwi.html?h=1222197
Server:Nginx / Varnish
Vary:Accept-Encoding
See if Referer:\<span> site blocked, contact your administrator/ said som.com or was empty then the link would work. Otherwise it gets redirected. That's just the logic of the hack so that it is more likely to go unnoticed.
It doesn't look like any scripting is involved. If an application was involved it seems like your website would not be targeted specially unless there is something about your host that makes it vulnerable, but an application could do all of this without ever connecting to your host.