redirect to x10powered.com

[dutchy_nl3669]

hi,

when I tried to log into my forum the page redirects in less then a second to 10xpowered.com. There it tells me "This domain name expired on Oct 15 2011 03:14AM, Click here to renew it." The link brings you to a login site, not looking like it's from x10hosting.
I don't trust this and think my account might be compromised.
The same happens when I click on an other link, In-Game-Stats, in my website(d'tor).
It also happens to some of the sub pages in the "statistics" on my site.

If my domain is expired shouldn't all the pages not give an error message?


When trying to log into cPanel the normal page doesn't show up. All white and everything is on the leftside. The bottom footer is saying "What was Beethoven's favorite fruit?
BANANANAAAAA!
This to me is really weird and I don't dare to sign in incase it logs my details and sent it to someone else.

Can someone have a look for me if this is compromised or tell me how to fix this.


regards dutchy

[Dead-i]

Is your site on x10Premium? If so, please create support tickets from within the client area:
https://clients.x10hosting.com/

[dutchy_nl3669]

I'm on the free x10 hosting plan.

regards dutchy

[essellar]

For what it's worth, I'm not seeing what you're seeing. I just get your site (as I suppose you intended). You may be seeing a man-in-the-middle attack. Can you post a tracert to the suspect domains?

[dutchy_nl3669]

how do I make a tracert from the suspected domain?
something like this?
Tracing route to dtor.tk [173.245.61.40]
over a maximum of 30 hops:

1 8 ms 7 ms 7 ms cpc2-telf10-2-0-gw.wolv.cable.virginmedia.com [94.172.48.1]
2 10 ms 10 ms 7 ms telf-geam-1a-ge114.network.virginmedia.net [80.3.159.89]
3 12 ms 9 ms 11 ms wolv-core-1a-tenge72.network.virginmedia.net [62.30.254.49]
4 11 ms 11 ms 11 ms manc-bb-1c-ae8-0.network.virginmedia.net [212.43.163.241]
5 9 ms 23 ms 13 ms manc-bb-1a-ae11-0.network.virginmedia.net [213.105.159.85]
6 30 ms 79 ms 29 ms ams2-ic-1-ae0-0.network.virginmedia.net [62.253.188.158]
7 31 ms 43 ms 35 ms 195.69.147.140
8 29 ms 31 ms 32 ms cf-173-245-61-40.cloudflare.com [173.245.61.40]


Trace complete.
regards dutchy

[essellar]

If you're on Windows, open a command prompt window (it will be under Accessories in the Programs menu). You should see something like this:

C:\Documents and Settings\User Name>_

Just type "tracert www.whatever.com" and hit Enter. The computer will fill the screen with all of the routing information for the request -- what servers it had to visit along the way, how much time everything took, etc. If you right-click on the "C:>" icon in the window, it will pop up a menu. Select Edit->Select All, then Edit->Copy. You can paste it into a posting here. You can do the same thing from the command line in Linux or OS X (but you should be able to copy directly rather than using a menu).

[dutchy_nl3669]

Thanks for helping,

as you can see I edited the post with those results.

Here are 2 screen shots I took of what I see.

this is what I see when trying to enter the site "www.x10hosting.com"

This is what I see when opening pages from my site.

hope this helps solving

regards dutchy

[essellar]

Looks like you figured it out while I was answering. There appears to be a lot of unnecessary bouncing around before you leave virginmedia, but I'll leave the examination of the route to the sysadmins here -- I'm not sure whether that bare IP should be in the loop. You might want to contact Virgin (your ISP, I presume) to see if the in-network routing looks normal to them as well.

[dutchy_nl3669]

Your right about Virgin Media, their my provider. Unfortunately there customer support isn't what it used to be and I'm probably in better hands here.

Let's hope there is a sysadmin near today.

regards dutchy

---------- Post added at 02:01 PM ---------- Previous post was at 01:57 PM ----------

the bare IP looks like it's from Cloudflare, could it be thet from there the redirect comes?

[dutchy_nl3669]

I'm sure this is not how cPanel login screen should look and loggin into might send my details to the wrong place.

I've ran Avast anti virus on my pc with no virus result on my side.

regards dutchy