Ora il sito è tornato. E' stato rilpulito dagli hackeraggi. Partirà a giorni un nuovo sito templari.in. Di seguito riporto la lettera che mi è stata inviata dai propietari dello spazio dove risiede il dominio magiaonline.net. Attendo vostre domande esoteriche
NEW INFORMATION: IMPORTANT
The IP address 46.30.240.132 corresponds to a web site that is infected with a spam or malware forwarding link.
The website's host name is "magiaonline.net", and this link is an example of the redirect: magiaonline.net
In other words the website "magiaonline" has been hacked.
The web site "magiaonline.net" may not be familiar to you. This means that another customer of your provider is hosting their web site on the same IP address as you. In that case, you really need to get your provider to assist you.
Usually, the redirect takes the user's browser to a spam or malware site. It's usually fake russian pills or pornography.
Usually, the infection is a Cpanel, Plesk, Joomla or Wordpress CMS install that has become infected either through a vulnerability (meaning the CMS software is out of date and needs patching), or the owner of "magiaonline.net" has had their account information (userids/passwords) compromised. Then malicious software/files are being uploaded by ftp or ssl.
It is often simplest to disable or suspend the web site (meaning you can delist the IP to resolve your CBL listing issues) and then deal with the problem in a somewhat more leisurely/less-urgent fashion.
In many cases, particularly with older compromises, the criminals that hacked this site will have uploaded a wide variety of spamming and other compromise tools. Therefore, the account corresponding to "magiaonline.net" needs to be examined very carefully for signs of tampering. Further, the criminal will even modify existing web pages (particularly magiaonline to have hidden references to pill/drug/porn sites. If you're not completely certain that you've removed all traces of the compromise, we strongly recommend reinstalling the site from scratch.
Furthermore, the site's passwords MUST be changed, and the customer should run anti-virus scanners on their own personal computers immediately to try to find and remove any keystroke loggers.
We believe that the malicious redirects are done by altering web server access control mechanisms (example, ".htaccess" files on Apache web servers), and causing the redirect to occur on all "404 url not found" errors. We would appreciate it if you can give us copies of the modifications that this infection has made to your system.
If you do not recognize the hostname "magiaonline.net" as belonging to you, it means that some other account on this shared hosting site has been compromised, and there is NOTHING you (or we) can do to fix the infection. Only the administrator of this machine or the owner of "magiaonline.net" can fix it.
Delisting this IP Address
Once the problem is removed, come back to this link (do another lookup) and you will be offered a link to self-delist. If you keep your browser on this page, you merely need to do a "page reload". Alternately, you can just revisit this link
Indice
