[Pro] Freeway site 'Hijacked'?

Hiya,

I have a site made with freeway pro 5.5 - www.castlerising.com The site is fine when one types the URL directly but any search for ‘Castle Rising’ using google, bing, yahoo etc lists the correct results but the site is hijacked when you click on the link and goes to powershoes.eu??? I have been in touch with the hosting company to see if the site has been compromised but they tell me it hasn’t. Is there any way to tell whats going on here so that I can correct things?

Many thanks,

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Absolutely bizarre sorry had to jump in I lived next door to that place for a looong time! (Well born in Kings Lynn, then moved to Swaffham).


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

It looks to me like the site is compromised ! Check the robot text


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

I don’t actually see any Google results for www.castlerising.com although there is a result for www.castlerising.co.uk and that link goes to the shoes domain you mention so do you mean castlerising.com or castlerising.co.uk?

Maybe that would answer things for you.

On Aug 18, 2014, at 9:38 PM, Nigel Gilbert wrote:

Hiya,

I have a site made with freeway pro 5.5 - www.castlerising.com The site is fine when one types the URL directly but any search for ‘Castle Rising’ using google, bing, yahoo etc lists the correct results but the site is hijacked when you click on the link and goes to powershoes.eu??? I have been in touch with the hosting company to see if the site has been compromised but they tell me it hasn’t. Is there any way to tell whats going on here so that I can correct things?

Many thanks,

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Hi

I have .co.uk set up to point to the .com

Thanks

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Hi

Sorry - other way round .com points to .co.uk

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

When I enter your .co.uk domian it doesn’t go to the .com domain, it stays at the .co.uk domain.

On Aug 18, 2014, at 9:52 PM, Nigel Gilbert wrote:

Hi

I have .co.uk set up to point to the .com

Thanks

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Hi

This is a setup that i’ve inherited. I only upload my freeway site to the .co.uk

Nige


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

I am in Spain and I just clicked the ‘Translate’ link beside the Google result for your site and your castle rising page loaded in Spanish as I would have expected, I then clicked the Google result for your page and it loaded there after without diverting to the Shoe site.

On Aug 18, 2014, at 10:2 PM, Nigel Gilbert wrote:

Hi

This is a setup that i’ve inherited. I only upload my freeway site to the .co.uk

Nige


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Hi

I think i have identified a rouge default.asp file on the host server. I’ll do a clean install and see what happens.

Thanks

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Yeah def a rouge file there somewhere


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Hi,

OK, seems to back back to normal! I can only assume the host site was compromised to allow this rouge file to be uploaded? I’ve changed all the passwords for the host, not sure if there is anything else I can do? Could it possibly be anything to do with a compromised upload from my mac via Freeway?

Thanks

Nige.


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Sorry going off the point - but when were you in Swaffham, Justin. I went to the Secondary in late 70s and my parents still live there!


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

Could it possibly be anything to do with a compromised upload from my mac via Freeway?

Nope - very unlikely.

I’ve changed all the passwords for the host, not sure if there is anything else I can do?

Ask your hosting service to keep an eye out for suspicious activity.

I hope your rouge file has gone green now :wink:

David


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options

I have family there too - so go back every so often. I was at hammonds high school until 87… So we probably missed each other there - I drink in the greyhound and what was the kings arms!


freewaytalk mailing list
email@hidden
Update your subscriptions at:
http://freewaytalk.net/person/options