[Solved] Wiping out account

[gmpintus]

Good morning,

account: gmpintus

email: gmpintus@gmail.com

Could you reset my account, please. I'm experiencing attacks on my website https://professorparticular.info.

Thank you

[MoneyBroz]

3 hours ago, gmpintus said:

Good morning,

account: gmpintus

email: gmpintus@gmail.com

Could you reset my account, please. I'm experiencing attacks on my website https://professorparticular.info.

Thank you

What kind of attacks?

[gmpintus]

my website is now redirected to gg.gg, which is a short address generator website. The original redirection was trying to force visitors to install a Rar document. Something like "ChromeUpdate.rar". Hense, I thought to delete all infos in my Plesk.
I manually deleted all my files from Plesk but still I get this redirection. Do you think there is something to do with Cloudflare?

[Unknown025]

If you'd like, an administrator can check your account to see if there's anything abnormal. Otherwise, I can delete your account and send you a new invite.

[MoneyBroz]

5 hours ago, gmpintus said:

my website is now redirected to gg.gg, which is a short address generator website. The original redirection was trying to force visitors to install a Rar document. Something like "ChromeUpdate.rar". Hense, I thought to delete all infos in my Plesk.
I manually deleted all my files from Plesk but still I get this redirection. Do you think there is something to do with Cloudflare?

Seems like some kind of sql injection or someone has compromised your account.

[wolstech]

This account needs to be recreated. The document roots are all missing (a bit of a pain to fix, when removing infected websites its best to remove the contents of the docroot but not the folder itself) and it's redirecting for me when I see no reason it should be (though obviously CF could be messed up). It's also an old cPanel migration account, so it had likely had a bunch of quirks from that as well.

An invite for a replacement account has been sent to you. Let us know when it's recreated and we can restore your legacy .heliohost.org subdomain and add professorparticular.info back to it.

 

[gmpintus]

I recreated the account. A temporary website gmpintus.helioho.st. But I cannot change my domain settings nor add SSL certificate.

 

I would like to add professorparticular.info, please.

[wolstech]

Added. I also added the gmpintus.heliohost.org back as an alias for you (if you want this to be your main domain again, let me know).

It may take up to 2 hours to start working.

[gmpintus]

OK, things are looking almost good. I redirected the DNS from the domain site to ns1.heliohost.org and ns2.heliohost.org.

It is supposed to load the folder /professorparticular.info with its index.html but it's not loading. Any clue?

[wolstech]

The domain is working for me and I see the default Plesk page for that domain.

You might need to clear your cache or wait for DNS to finish updating everywhere...

[gmpintus]

Yes, I'll wait to finish updating. I see the Plesk page too, but it should load my index.html page.

But I noticed that https://professorparticular.info/professorparticular/professordeinglesitaliano.html is loading correctly. Whereas https://professorparticular.info/index.html is being directed to Plesk page.

[wolstech]

Both links open your website for me. I don't see a plesk page when I click either of those.

You probably need to clear cache or possibly your ISP has a stale cache that needs to expire...

[gmpintus]

Here it is: https://professorparticular.info/index.html

for some reason the previous link was directed to another folder.

It is still the Plesk page.

 

[gmpintus]

Now it's working 🤙. Thanks Wolstech!

[wolstech]

Good to hear. It looks like you didn't delete the default index.html file. Note that because of the way that index.html file works, you cannot just edit it and expect it to work. You actually have to delete that index.html that comes with Plesk, not just edit your content into it.

It looks like you figured it out while I was looking at it.