wolstech

The account pmtech has been deleted. Give it an hour, then sign up again. If you need a new invite, please let me know.

Johnny is known for poor uptime and is meant for experimental use where accessing it reliably is not a concern. It will likely come back up on its own in due course. If you need reliable service, consider switching to Tommy or Ricky.

Your account is in line to be created. It can take several hours (usually up to 12, but longer in some cases) for an account to be created and fully working.

It was due to the domain having leftover DNS entries. The domain femiige.com has been cleaned up. Please check your mail for a new invite.

This account has a compromised CMS installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, when selecting a CMS, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised CMS installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, when selecting a CMS, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised CMS installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, when selecting a CMS, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

It's suspended for AnonymousFox'd WordPress, but I don't even see WP on your account and there's no visible malware either. Not even a database. I'm going to let Krydos look at this one.

This account has a compromised CMS installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, when selecting a CMS, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

I saw those as well. I have to look through the accounts listed inside though in order to see if they're actually hacked. The WHMCS ones are unlikely to be affected since that program is prohibited and won't even run here. EDIT: Just confirmed that 2 of the Joomla sites listed inside that folder are also compromised... Also, how are you able to still see that folder when you're suspended?

It was removed by Krydos as he'd rather the info not be published for security reasons.

No I did not. That set of files showing up today means the hacker still has active access to your account. It's been banned. Please use the invite I just sent. See this topic if you wish to speculate on this...https://helionet.org/index/topic/33637-anonymousfox-the-motherlode/

That's the stuff AnonymousFox used to compromise the server by the looks of it. We thought metals was to blame, but it looks like your account may be the initial entry point based on that. Krydos and I will find those files very interesting, and some security researchers may as well. EDIT: You will be getting a new account. There's things like direct symlinks to system files on your account. An invite will be sent shortly once I get your domains released so you can use them again.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

@Byron: That's not actually high load. There's malware on it (looking deeper shows there's actually phishing too...). The diagnostic script for these won't flag infected files though, so it only reports infected if the AnonymousFox user exists in the WP DB.

The domain lslab.heliohost.org has been cleaned up. Try again now. A new invite has been sent.

It won't stay unsuspended so I may end up needing to give you a new account after all. I'll take a closer look when I'm at a pc later this morning. EDIT: You missed a malicious index.php in the root of public_html. I've deleted it for you and took a look through your other folders. Your account now seems to be staying unsuspended. I put in a test index file pointed to /wp/ so your dir listing isn't showing, however I don't know if the content is correct for the domain.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended.<br /><br />An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing.<br /><br />As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.

I unsuspended you again. I think you still have something compromised though. Our servers were updated yesterday to auto suspend anyone who executes the malicious files or has the anonymousfox user present. Note that even though WP is the attack vector, we've found the hacker sometimes places the modified index.php files and the malware random number files well outside of WP installs on compromised accounts. Open all of your index.php files and ensure there's no random gibberish or eval statement at the top.

You should have already received it. Resent.

This account has a compromised WordPress installation that has been affected by the recent AnonymousFox hack and cannot be unsuspended. An invitation will be sent to you shortly so you can create a new account. Please restore your data using a backup. The data from your old account cannot be recovered or returned to you due to the possibility of the account having been used for Phishing. As a reminder, we highly recommend that users not use WordPress. WP and it's extensions are notorious for having security issues such as the one you (and everyone else on Tommy) experienced, and it has the worst security track record of any CMS out there. Using a different program will help prevent this from happening again.