Krydos

@byron, to save time you can just use the multimod labeled "Malware Found", and copy paste the "Malware. 1 file(s). HTML.Exploit.CVE_2013_0026" part into the blank provided. @fsps, your account is showing up as clean now. Thank you for taking care of this.

Dedicated IP granted.

Dedicated IP granted.

Sounds like it might have been caching of some sort. Glad you got it figured out.

The reason you are receiving a redirect to defaultwebpage.cgi is because the redirect is saved in your browser cache. Your site, bvcx.org, is showing "kk". Your account has been moved to an IP address that should be accessible in China.

Try recreating your account now. Remnants of jamesnb.com have been found on the system and removed. Let us know if you're having any other issues creating your account.

The reason your account was suspended is because kikicatr@hotmail.com reported an email you sent them as spam. -------- Original Message -------- Subject: [HE ABUSE #426072][65.19.143.2] complaint about message from 65.19.143.2 Date: Thu, 18 Jul 2013 11:02:53 -0700 (PDT) From: no-reply@abuse.he.net To: abuse@connexinternet.com We have received a complaint about your account. Please investigate and fix within 24 hours. Hurricane Electric Abuse Department support@he.net From staff@hotmail.com Thu Jul 18 11:02:50 2013 Return-Path: &--#60;staff@hotmail.com&--#62; X-Original-To: report@abuse.he.net Delivered-To: report@abuse.he.net Received: from he.net (he.net [216.218.186.2]) by abuse.he.net (Postfix) with SMTP id DDD885404C2 for &--#60;report@abuse.he.net&--#62;; Thu, 18 Jul 2013 11:02:49 -0700 (PDT) Received: from bay0-omc4-s16.bay0.hotmail.com ([65.54.190.218]) by he.net for &--#60;abuse@he.net&--#62;; Thu, 18 Jul 2013 11:02:01 -0700 Received: from BAY0-XMR-009.phx.gbl ([65.54.190.200]) by bay0-omc4-s16.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 18 Jul 2013 11:02:02 -0700 Received: from mail pickup service by BAY0-XMR-009.phx.gbl with Microsoft SMTPSVC; Thu, 18 Jul 2013 11:02:01 -0700 Date: Thu, 18 Jul 2013 11:02:01 -0700 From: staff@hotmail.com Subject: complaint about message from 65.19.143.2 To: abuse@he.net MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="6E898D45-5191-4FC7-81DB-ACE0377B00FC" Message-ID: &--#60;BAY0-XMR-009x5XL7kb005dbebd@BAY0-XMR-009.phx.gbl&--#62; X-OriginalArrivalTime: 18 Jul 2013 18:02:01.0855 (UTC) FILETIME=[E76768F0:01CE83E0] --6E898D45-5191-4FC7-81DB-ACE0377B00FC Content-Type: message/rfc822 Content-Disposition: inline X-HmXmrOriginalRecipient: kikicatr@hotmail.com X-Reporter-IP: 74.36.153.15 x-store-info:fHNTDlzCF8Nxw6HwcfGQy+S7Ax/lqLSmZCJvzMexS1mAUZcOyDqLgUCrmas2PHqu++7djpfOSVsulGxBQRAplJS8ZF1s2sBPZJCTL6qKalpDdEkoOUweVJnSOTZGW1kAIxlU2jviLZs= Authentication-Results: hotmail.com; spf=none (sender IP is 65.19.143.2) smtp.mailfrom=encody@stevie.heliohost.org; dkim=none header.d=encoder.heliohost.org; x-hmca=none header.id=board@encoder.heliohost.org X-SID-PRA: board@encoder.heliohost.org X-AUTH-Result: NONE X-SID-Result: NONE X-Message-Status: n:n X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MjtHRD0yO1NDTD0w X-Message-Info: 3c21WZ1hAlv9hC/v+9LYnYpOwXwrtVUGeLUhtl31COXE+QV47K8D2F+e8YjeMH/goNJLPohia9LW7JDtKQ/ouHt6z1yMzPytKvz+b7T05njDQRzx1jd/uCLNxjB8qCOUVxfY7jBINgR4t/Su1m9yKhLpOpZ2NJcs3Qyanpj12jQ= Received: from stevie.heliohost.org ([65.19.143.2]) by BAY0-MC3-F31.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900); Mon, 15 Jul 2013 13:31:35 -0700 Received: from encody by stevie.heliohost.org with local (Exim 4.69) (envelope-from &--#60;encody@stevie.heliohost.org&--#62;) id 1UypR8-0000hY-Pe for kikicatr@hotmail.com; Mon, 15 Jul 2013 13:31:33 -0700 To: =?UTF-8?B?SUxPVkVNSU5FQ1JBRlQ=?= &--#60;kikicatr@hotmail.com&--#62; Subject: =?UTF-8?B?QWN0aXZhdGUgdXNlciBhY2NvdW50?= From: &--#60;board@encoder.heliohost.org&--#62; Reply-To: &--#60;board@encoder.heliohost.org&--#62; MIME-Version: 1.0 Message-ID: &--#60;732304831568060a170ade2dafe311de@encoder.heliohost.org&--#62; Date: Mon, 15 Jul 2013 13:31:58 -0700 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: phpBB3 X-MimeOLE: phpBB3 X-phpBB-Origin: phpbb://encoder.heliohost.org/DNASite/phpbb X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - stevie.heliohost.org X-AntiAbuse: Original Domain - hotmail.com X-AntiAbuse: Originator/Caller UID/GID - [27184 32003] / [47 12] X-AntiAbuse: Sender Address Domain - stevie.heliohost.org X-Source: /usr/bin/php X-Source-Args: /usr/bin/php /home/encody/public_html/DNASite/phpbb/ucp.php X-Source-Dir: encoder.heliohost.org:/public_html/DNASite/phpbb Return-Path: encody@stevie.heliohost.org X-OriginalArrivalTime: 15 Jul 2013 20:31:35.0480 (UTC) FILETIME=[4CDCAB80:01CE819A] Hello, The account owned by "Belocheetty" has been deactivated or newly created, you should check the details of this user (if required) and handle it appropriately. Use this link to view the user's profile: http://encoder.heliohost.org/DNASite/phpbb/memberlist.php?mode=viewprofile&u=201 Use this link to activate the account: http://encoder.heliohost.org/DNASite/phpbb/ucp.php?mode=activate&u=201&k=3A0J6HA -- Thanks, The Management --6E898D45-5191-4FC7-81DB-ACE0377B00FC-- If you're not already aware, our terms of service state Since someone reported an email from your account as spam that means that your account violated the terms of service, and was suspended. I'm really not sure why kikicatr@hotmail.com reported this email as spam though. You would have to ask them to know for sure. Since the email that was reported does not appear to be spam to me I'm unsuspending your account for you.

aroundthetalk.com has been created on the account teleport as an addon domain.

Checking the shared ip address in a browser directly will always result in seeing the queued page, because there are literally thousands of websites that you could be requesting from that ip and without letting apache know which one you're looking for it doesn't know which page to serve you. However, there is a way to check if a server is ready to display your site correctly without changing your nameservers, but it takes a little more technical know-how. For example: curl -H 'Host: burakkurkcu.com' 64.62.211.131/index.php

I have tested emails sent from and received by the stevie server and everything appears to be working. I would recommend checking your settings as iceit suggested. Let us know if you're still having problems with this issue.

The problem was you (or some program on your computer) tried to log in with the wrong password so many times that our server decided that you were a hacker trying to illegally gain access to an account that wasn't yours and locked you out. The most common reason that this happens is when you save a password in an ftp client, and then change the password but don't change the saved password in the client. Then the ftp client stupidly tries to log in with the wrong password over and over until you aren't able to log in at all. There can be plenty of other causes, but this is the most common that I have seen.

Log into your account at http://dot.tk/ and select custom dns, then type 'ns1.heliohost.org' as one nameserver, and 'ns2.heliohost.org' as the other nameserver. EDIT: It also appears as if you haven't registered the domain dhen-kreasi.tk yet so you'll need to do that too.

Upon closer inspection it appears as if benny018 triggered brute force protection by trying to log in with the wrong password too many times. I have manually removed this block. Let us know if you are still unable to log in or reset your password.

<?php require './wepay.php'; WePay::useProduction('YOUR CLIENT ID', 'YOUR CLIENT SECRET'); Just download the wepay.php file from their site and use the code above to include it.

Done.

benny018 does exist and is active on Johnny, and his domain works and loads a fresh Wordpress install. He might need a manual password reset though if he can't log in. No idea why he made his link open fbcontest.heliohost.org though. That part is a mystery to me.

Where did you find that?

Please clear your cache.

Please clear your cache.

Please clear your cache.

Since both accounts in question were last logged in yesterday I'm going to assume that you got this figured out on your own.

The site tries to go to Johnny because you have an a record with a Johnny ip address. http://byrondallas.heliohost.org/php/tools/dns_records.php?domain=ejanta.com&rec=A

Does it work now?

This has not been taken care of yet. Here is a hint: /home/santas/public_html/html.html

This hasn't been taken care of yet. Here is a hint: /home/bilhos/public_html/folder/iclerdislar.html