All Activity

The files from your old account can be downloaded from https://heliohost.org/backup/

Username: heliogeorge, Server: Johnny, Main domain: heliogeorge.heliohost.us Good morning, I just now tried to recover my old account (heliogeorge), however, I can't find my website (heliogeorge.heliohost.us) anywhere, and the "files" directory appears to be empty. How can I recover them? -- Heliogeorge

Hi Wolstech, Following up on this thread; wanted to flag something I found while cleaning up after the recent incident, in case it's useful for your records. While reviewing my ngo.helioho.st site (a separate, non-WordPress domain on this account) I found two files that don't belong there: a heavily obfuscated backdoor named mac.php (last modified June 11, ~7:49 PM), and an injected index.php containing a remote-eval payload pulling from 63.141.235.34, plus a redirect to a suspicious shortened link, swiy.co/goodrich555 (modified June 13, ~7:07–7:12 AM). Both timestamps are before your review where you mentioned nothing looked suspicious outside lda.ng, so this looks like it's from the same intrusion window, just on a domain that isn't WordPress and may not have been part of that check. Tried backuing up existing WP installs like ths.helioho, but i encounter Host Build interrupts sue to things like allowed runtime and PHP max execution. I've already renamed both files to .infected to disable them and remove them from execution and I'm restoring a clean copy of that site myself. I'm not asking for another account-wide reset; this is contained and I'm handling it, but since I don't have shell access to search file contents across the rest of the account, Since this looks like leftover from the same incident rather than a new one, I wanted to flag it rather than sit on it. Would it be possible to do a targeted check for similar files on my other domains rather than a full account reset?-since the rest of the account otherwise appears unaffected. Happy to send over the exact file contents if that helps your scan. Thanks again for the help.

Username: N/A, Server: N/A, Main Domain: N/A Priority: 9/10 Hello, my account and services insides faced a problem. All services are not working, they return the error 503. Service unavailable. This occured when I sent you a message to reset the plan because they was useless projects inside, but instead of doing that you added files and that hit my plan storage(1117MB / 1000). So now, I want to reset all because I have merged the database before, and not I can restart. That means, delete all files of my account and I'll make new files. username: gentillenoir075 email: gentillenoir075@gmail.com plan: Morty. Priority: 9/10 Urgence : 10/10 Make it as soon as possible because the website serve many peoples.

I also wanted to let you know that when I go to the wiki, it says my ip is blocked or something. My ip address is 73.144.3.243 not sure what's going on with that, I can access everything else just fine.

Hi, I was wondering if someone could help me install the hestia control panel on my vps, I'm still learning command line stuff and am afraid I'll frickin break something. I do have a domain I can point to the ip, but I'm not sure if I set that up when I login to hestia or not, if someone could explain what I do next after it's installed that would be very helpful. A suggestion for a tutorial would be helpful if maybe at some point, someone could do a youtube video or online walkthrough on how to install it on a fresh vps, I would like to learn for the future, and I think it would be fun for others to learn as well. Thanks for the help.

Your current balance is $6.6407 plus $15 plus $3 bonus brings your new total to $24.6407. Based on your load for the last 30 days your new estimated expiration date is 2026-08-24. If your load increases this could run out sooner or if your load decreases it could last longer though. We'll email you occasionally to let you know how your balance is being used. Thanks for increasing your Morty balance.

This support request is being escalated to our root admins.

Please add USD 15 to the fund on my account. Username: talesaz Email: azevedotales@outlook.com PayPal Transaction ID: 93A566505U473851L Thanks!

Number 2 is correct, you'll get a blank OS with SSH access to setup whatever you want. If you aren't used to the command line of linux then we can install a control panel such as Hestia for you.

I want to upgrade to a VPS account. 1. Will my current data i.e. domains, emails, files etc be migrated to the VPS account or will I have to do it myself OR 2. Do I get a blank VPS and the existing hosting account maintained?

In order to reset your account we must first verify your email address. This is to prevent someone from pretending to be you to delete your data. The easiest way to verify your email address is to send an email with the text "please reset my account" to support@heliohost.org from the email address listed in the top right corner of https://heliohost.org/dashboard/ Once we've verified your email address we will be happy to start the reset for you.

Are you able to access the wiki now?

Installed. You can see the current list of installed modules for Johnny's Python 3.14 at https://johnny-info.heliohost.org/pyinfo/info3.14.py Installed.

Alright, it looks like the Ubuntu 26 installer works again. You should have just received an email that your VPS is ready to go. Thanks for your patience and thanks for helping us test the new OS.

What is your username?

Username: N/A, Server: N/A, Main Domain: N/A Hello, I am currently researching webhosts for a Minecraft community. I came across HelioHost and I am very interested. My IP address was included in a blocked range due to malicious traffic. I am using T-Mobile 5G Home Internet. Please unblock the following IP address(es): 172.56.80.97 Thank you, and I look forward to working with you all soon! -- Jesse

No worries waiting

Username: N/A, Server: N/A, Main Domain: N/A Hello, i face a big problem. My website is nolonger accessible, it return 503 error. And i see this : 1017.1 MB used of 1000 MB, that's why i get this problem, but i was not this problem. When you made a modification i told you, Its on that time i faced this error. It's an urgent to reset my space disk, because it's only that site running there, and it can not cost much place. So, You have to reset, and if possible delete all datas inside, because i can redeploy an other site directly. When you made that modification, you added other files but i didn't say to add files, that why my capacities wa over. Reset all datas of my project please Emergency: 10/10 Priority: 9/10

The contents of the domain lda.ng have been discarded, the associated WP database developer1_lda has been dropped, and you've been unsuspended. Your account may take up to 2 hours to function fully. The attack came in through Wordpress itself, which is usually either a result of plugins with vulnerabilities, or failure to install updates. A backup from February actually does exist for your account at https://heliohost.org/backup/ if you need anything from that timeframe. You can make backups using the backup tool in Plesk. Note that if you use this, it is advised that you configure remote storage, as the backups it creates count towards your disk space quota and can quickly cause you to run out of space.

wow, please don't reset as i haven't performed a full backup. i am okay with clearing/deleting the contents of the lda domain etc. for it to be unsuspended. Once restored i will create a full backup of the entire account so that i can avoid any major losses going forward. I would appreciate it if you can Kindly pin point me to an article/guide on how to do a wholistic backup for the whole account so i can reduce my exposures. Also any further information on how this attack was perpetuated/what exactly was affected, will go along way. Thanks!

Krydos can install this for you.

Our policy is typically to require the entire account be reset without a backup to destroy the contents before you can recover a hacked account (in case phishing or similar was set up and stolen information is present), though after looking through your account I don't see anything suspicious outside of the one domain that was compromised (lda.ng). Are you OK with deleting the contents of the domain lda.ng and the associated WP database to be unsuspended?

Thank you, I am forwarding him how to archive the account.

Hi, I've checked the list of modules already installed on Johnny for Python 3.14 at https://johnny-info.heliohost.org/pyinfo/info3.14.py and confirmed these are not installed. Username: prabhatyadav2003 Server: Johnny Python version: 3.14 Domain: notrack.co.uk Modules needed: pymysql This is required for my Databases setup " notrack.co.uk ". **`ffmpeg` is available on Johnny? Please confirm me that too.