this site has been hacked

[Brent Mills]

Thanks Patrick...I have scoured every file on the system numerous times looking for anything relating to cloudfront...even things like cfasync and still have not found any reference in site files or database. I had another party that I am paying scan as well, looking for the culprit, and as of yet they have not found anything. Not done working on this of course...just that this is not a simple issue.

[patrickt]

Originally Posted by Brent Mills

Thanks Patrick...I have scoured every file on the system numerous times looking for anything relating to cloudfront...even things like cfasync and still have not found any reference in site files or database. I had another party that I am paying scan as well, looking for the culprit, and as of yet they have not found anything. Not done working on this of course...just that this is not a simple issue.

If you just go to QuickLinks, Today's Posts, and then with your browsers go in to "View Source" mode and do a search for cloudfront.net it'll jump right out at you. Now, how it's getting injected in to there is another story. I've set up a rule to block d3qk9u6c2k2cid.cloudfront.net/* which, of course, is a temporary fix.

[Blas]

Just logged on with my iPhone and no redirects yet.... so you must be on the right track... Blas

[twobjshelbys]

I had closed my tab on my Windows Firefox because of the windows redirects but had to restart firefox and came here more or less out of habit. The windows redirect didn't happen (but it sometimes took a while). I won't know about mobile until I do my nightly scrub at about 8:00 this evening.