Nadj website

[MikeW]

Anyone else having a problem getting into the NADJ website at the moment. Can't get on via my laptop or iPad.

[Cowlinn]

I'm getting



Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 7680 bytes) in /home/nadjonli/public_html/index.php on line 15


Means nothing to me, but it doesn't sound good! :eek:

[MikeW]

I'm getting



Means nothing to me, but it doesn't sound good! :eek:

That is what I am getting.

[mark@pegasus]

Same here

[DeckstarDeluxe]

Have you guys emailed Paul to let him know?

[Marc J]

It's a little different now :eek:

[Cowlinn]

It's a little different now :eek:

:eek: :eek: Oh dear..

[MikeW]

That all looks a bit worrying!

[Vectis]

Oops.

Probably not a good idea to go visiting for a short while folks just in case there's any nastyware hanging around... :(

[Marc J]

:agree: There's (currently) nothing sinister in the source, but that could, of course, change so that's good advice.

Looks like a script kiddy with nothing better to do....:muppet:

It's probably worth mentioning that if you're hosted by NADJ (as I know a lot of you are), you should check your own sites.

Depending on the server setup a compromised account can provide access to other accounts on the same server. This kind of thing can happen on a shared server, and sometimes it's not even your own account that's been the entry point.

Take note - you should keep regular backups of your site(s) - files AND database(s).

[DeckstarDeluxe]

Just sent a message to John and they are aware of the issue and are working to resolve :).

[Cowlinn]

Seems like it's up and running again now.

[Peter Lockwood]

it was hacked at 10 30 ish paul as now uploaded the back up

[pdarnett]

Looks like its a dictionary based password attack, we've dealt with it now and no-ones hosted sites have been affected and the website is back up safe and sound, good advice above about having backups of your websites, this didn't just happen to us as this is an automated attack coming from an African ISP, the list gets bigger here http://www.zone-h.com/archive/notifier=Xrapt0r

We've been doing the due diligence since 10:29am this morning to block suspicious requests to the site and we've reset every single admin level password just in case, those of you that host with us (or with anyone) that have "password" or their own name as their password may want to change it as this attack is worldwide on thousands of web hosts .

[Marc J]

We've been doing the due diligence since 10:29am this morning to block suspicious requests to the site...

With that in mind, I highly recommend you take a look at www.cloudflare.net. I'm testing it out on a few sites at the moment and my initial thoughts are that it is very good and does what it claims, very well.

Basically, you route your DNS through their system and anyone trying to access from a suspicious IP (checked against realtime blacklists from thing like Project Honeypot) will be challenged. A bonus is that all your static content is cached on CloudFlare's global CDN (content delivery network) and Javascript is auto-minified, so visitors see an improvement in site loading times and you save on bandwidth :) There's a bunch of other benefits...check it out!

P.S. - I'm not affiliated with CloudFlare in any way!

[Marc J]

no-ones hosted sites have been affected

Are you sure? (http://www.chrisburforddj.co.uk) :eek:

[pdarnett]

Chris Burfords site was a brand new install of joomla with all default passwords etc, and thats now sorted..