Website compromised

[hadeyparty]

Urgent! I need help with admin panel.. My website is compromised via my admin panel

1. I cant change password because the change password feature wont work. The page only refreshes and does nothing
2. I urgently need to change it because I believe someone else has access to my website. My cpanel is protected via authy 2FA that's the reason I believe my website is being accessed somewhere else..

This scammer keeps changing my bitcoin wallet address. My customers send to his address instead of mine. I have bitcoin exchange website to my currency

I need your help guys

 

[Infopro]

You would do best to contact your Hosting Provider directly about this.

 

[hadeyparty]

You would do best to contact your Hosting Provider directly about this.

It seems they cant do much with the way the cc spoke to me.. he said I should contact a developer. its beyond my area of competence

 

[Infopro]

Well, security of the server your site is on is thier responsibility I would think. If your site’s been compromised they should be able to offer you backups to restore the account safely.

If thats not the case, you might need to take down the website yourself until you can rebuild or restore it to a Hosting Provider that's more responsive to your needs.

 

[hadeyparty]

I was attacked again 2 days ago.. I Lost $300.. I contacted my hosting, Namecheap, They said they are not responsible if a malicious script is in my files. This attack is a scheduled one, I think the hacker activates it at his best time I don't know how.. I am really suffering.. how do I stop this from happening? If I build a new website with new codes etc. The scammer will come after my domain and how am I sure he wont succeed again.. HELP!!

 

[cPanelLauren]

Hello @hadeyparty


The best advice I or anyone can give you is to contact and work with a qualified system administrator. If you don't have one you might find one here: System Administration Services | cPanel Forums


Thanks!

 

[ronaldst]

What is the cause of this compromise, do you know where the hacker gets access from?

I suggest you ask your host to disable your account while you figure out whats going on.

 

[hadeyparty]

What is the cause of this compromise, do you know where the hacker gets access from?

I suggest you ask your host to disable your account while you figure out whats going on.

I have 2FA enabled on my cpanel.. I am sure he did that without logging on my cpanel.. what he does is change my website BTC address ( This address is where sellers will send btc to). this attack is scheduled. it happens on 16th September, 16th October and Nov 6th.

 

[Infopro]

It sounds to me like whatever script you're using for the website, it's easily compromised. You should contact the author of that acript and ask them about this.

 

[ronaldst]

I find it concerning that one are able to compromise your account like this.

Are you on a shared hosting environment or run your own server?

Anyhow. I would ask the system administrator to change the account password and 2FA, and move your script/website to a non-public folder. When you regain control you need to figure out what is causing this to happen and fix it.

 

[hadeyparty]

I find it concerning that one are able to compromise your account like this.

Are you on a shared hosting environment or run your own server?

Anyhow. I would ask the system administrator to change the account password and 2FA, and move your script/website to a non-public folder. When you regain control you need to figure out what is causing this to happen and fix it.

Yes I am on a shared host