Gearslutz.com Hijacked?

MisterMark · Post by **MisterMark** » Thu Mar 01, 2012 7:14 am

Has anyone noticed when you go to gearslutz.com you get a portal to a porn site? Seems they may have been hijacked!

-Mark

farview · Post by **farview** » Thu Mar 01, 2012 8:42 am

Either it's fixed now, or your computer has been hijacked.

hasbeen · Post by **hasbeen** » Thu Mar 01, 2012 9:45 am

It may be fixed in your area but here in MA I am getting porn since last night.

hasbeen · Post by **hasbeen** » Thu Mar 01, 2012 9:49 am

Looks like it may be a cookie, google smart ad or cache thing, I am invetigating as it works on my phone.

T-rex · Post by **T-rex** » Thu Mar 01, 2012 9:54 am

Works fine here. Honestly though, with a name like gearslutz you are pretty much asking for it.

red cross · Post by **red cross** » Thu Mar 01, 2012 11:43 am

Hacked for me as well.

vvv · Post by **vvv** » Thu Mar 01, 2012 11:55 am

I'm in Chicago - it's hacked for me as well.

(Just another kinda porn, eh?

)

Recycled_Brains · Post by **Recycled_Brains** » Thu Mar 01, 2012 12:05 pm

Reason number 1,974,234 to not bother with GS.

MisterMark · Post by **MisterMark** » Thu Mar 01, 2012 12:27 pm

Hmmm... cleared my history and cookies and I'm still getting the porn portal... not looking for granny dating sites right now... any ideas?

-Mark

T-rex · Post by **T-rex** » Thu Mar 01, 2012 12:58 pm

What browser are you using? I am getting the normal GS site with Firefox and Chrome.

For the record I don't know jack about this kind of stuff, but I thought I would throw that out there since its working for me. Oh, I also get the normal site from my kindle. Have you tried your phone?

ulriggribbons · Post by **ulriggribbons** » Thu Mar 01, 2012 1:00 pm

Jules says a typo was made in one of the nameservers, and it will take a bit to repropogate. Give it some time...

juniorexploder · Post by **juniorexploder** » Thu Mar 01, 2012 1:36 pm

You can access GS via their IP address...but I believe it's read only....I tried to post an ad...no go.

here's the IP

http://176.56.59.10/board/

eh91311 · Post by **eh91311** » Thu Mar 01, 2012 1:57 pm

I'm blocked when using gearslutz.com, using IP address# direct works but I can't log in, read only confirmed.

Scodiddly · Post by **Scodiddly** » Thu Mar 01, 2012 5:25 pm

Recycled_Brains wrote:Reason number 1,974,234 to not bother with GS.

Pro Jules · Post by **Pro Jules** » Sat Mar 03, 2012 6:53 am

Hi TapeOp peeps

Sorry for being off-line on Thurs 1st March!

What happened?

Gearslutz changed web hosts back in June 2011 and the migration went well. During this migration an error was made when the nameservers were configured. One of the nameservers was misspelled and under normal circumstances this would have not caused any issues other than slightly less resilience in the DNS infrastructure.

On 1 March 2012 a hacker noticed this domain exploit and registered the misspelled domain name. They used this domain typo to redirect approximately 1/3rd of visitors to a "branded" web page that makes money off page clicks. Our web host corrected the misspelling as soon as it was identified at 7am GMT.

Why was this not resolved sooner?
The hacker used a domain name with a time to live (TTL) of one day. This TTL means that any forum users who were redirects to this branded web page would have it cached for 24 hours.

Was I hacked?
The aim of this hack was to make money from the hyper link clicks rather than compromise end users PCs and Macs. But to be on the safe side the techs at our server company scanned the web page - and confirmed no viruses or snide scripts. Your computer is clean!

Will this happen again?
No. The changes we've made are permanent and will stop this from happening again. We will also be moving our domain registration to our web hosting provider so any future updates will be handled automatically to prevent any further typos.

The end result was a typo over a year old caused the site to be inaccessible for 1/3rd of its visitors and boring wait until the DNS propagated.

Sorry for the interruption in service!

if you are still getting the bogus site here is a link that tells you how to flush your DNS http://www.tech-faq.com/how-to-flush-dns.html

Thanks

Jules
GS Admin

Message Board

Gearslutz.com Hijacked?

Gearslutz.com Hijacked?

Who is online