Web Hosting Plan - dofollow blog

16Nov/110

We are not a brand so cant be found anywhere

We are not a brand and cant be found anywhere! So why are you here?

Infographic by SEO Book

How to take screenshots on the Android HTC Sensation

I thought I would share this tip with you because I accidently took a screenshot on my android HTC Sensation.

So t take a screenshot and have it saved in the gallery automatically do this.

1. Hold the power button down on the top of the HTC Sensation

2. Press the House (Home) button on the bottom left of the phone at the SAME TIME.

By doing those together you will hear it click if you have the sound on and a message on the screen will tell you where it was saved.

This will probably work on other Android phones and should work on other HTC mobile phones. So give it a try and let us know so i will compile a list of which smartphones it works on.

enjoy

A new wordpress hack from a shared server that you can protect yourself against

We became aware of a hack that happens server side. The server managers said that they cant stop this type of hack because it would stop alot of wordpress sites from functioning. They did say exactly how the attack happened and what you can do to avoid this server side hack on a shared server.

No I will not be telling you how to do it or give you enough information to work it out

I will say that this hack is about linking configuration files for common scripts. What happened is clear from this log entry -

2.88.154.165 - - [16/Oct/2011:02:40:32 -0500] "GET / HTTP/1.1" 200 11823 "http://www.xxxxxxxxxxxxxxxxx.co.za/al/sql.php?action=viewData&dbname=xxxx24_wrdp1&tablename=wp_options" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

The bad IP is from Saudia Arabia - you might want to block that but they will just use another IP. they infulatrated this site due to a bad password -> http://www.xxxxxxxxxxxxxxxxx.co.za ... I removed the name because the site is still not fixed - 2 weeks after the event! I also didnt want to show you which server it is on but I will say that it is on the same server as the webpage I am writing about.

So what they did was hack that guys account. Then they got all the databases on the shared server. they also then got all the configuration files for those databases. The funny thing was they left them on the server for everyuone to see. So all 300 config files were open to the public - but not indexed by Google luckily.

So then they ran a script where they put the database and website we are talking about and then tried to hit the default table called "wp_options". In this case they got it and then they hacked the site and all others on the shared server.

So to avoid these types of hacks use not only the prior recommendations we have made but also:

1. Try and install your blog in a subdirectory not the main directory - www.xxx.com/blog/ etc. which is pretty hard in alot of cases these days as WordPress is more than just a blog now.
2. Change the default table names so they cant guess. In this case they never entered the site from the front end - just the server.
3. run your site on a VPS or a dedicated server as you will be the only one on it. So that another site does not take yours down!
4. Install this plugin which does most of this - http://www.websitedefender.com/wordpress-security-scan-plugin/
5. Have a read of this - http://codex.wordpress.org/Hardening_WordPress

In this case if the website we are talking about had done either of those 4 points the attack would not have succeeded.

Dont forget the other tips we have given here for front door hacks!

Finally for those of you who want to know here are the raw files -

The hacked main page -

<head>

<title>xxxxxx</title>

</head>

<body>

HaCkEd

by alsha67

[

alsha67

]

To Contact:

F8s-@Hotmail.com </div>

</div>

</div>

.. {

اجواء هادئه فـ لاصوت غير اصوات عزفنا على اوتار

الكيبورد } ..

</div>

</div>

Gr33tz to:

Nassori &

NeT DeviL

[

C0pyL3ft: 2009

// 2011 # ]

Saudi Arabia

HaCkEr</div>

</body>

</html>

and the raw server logs with just the usual modifiacations.
so if you see a hack like this then it has come from the server!

2.88.154.165 - - [16/Oct/2011:02:40:32 -0500] "GET / HTTP/1.1" 200 11823 "http://www.xxx.co.za/al/sql.php?action=viewData&dbname=xxx_wrdp1&tablename=wp_options" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:40:33 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:40:34 -0500] "GET /wp-content/themes/twenty11xxx/style.css HTTP/1.1" 200 53699 "http://www.xxx.net/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:36 -0500] "GET /wp-content/themes/twenty11xxx/images/search.png HTTP/1.1" 200 441 "http://www.xxx.net/wp-content/themes/twenty11xxx/style.css" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:44 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:45 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:54 -0500] "GET /wp-admin HTTP/1.1" 301 239 "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:54 -0500] "GET /wp-admin/ HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:40:55 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:40:55 -0500] "GET /wp-login.php?redirect_to=http%3A%2F%2Fwww.xxx.net%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 2123 "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:40:56 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:40:57 -0500] "GET /wp-admin/css/login.css?ver=20110610 HTTP/1.1" 200 2156 "http://www.xxx.net/wp-login.php?redirect_to=http%3A%2F%2Fwww.xxx.net%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:57 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 200 39648 "http://www.xxx.net/wp-login.php?redirect_to=http%3A%2F%2Fwww.xxx.net%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:59 -0500] "GET /wp-admin/images/button-grad.png HTTP/1.1" 200 243 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:40:59 -0500] "GET /wp-admin/images/logo-login.png HTTP/1.1" 200 8891 "http://www.xxx.net/wp-admin/css/login.css?ver=20110610" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:02 -0500] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 284 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:02 -0500] "POST /wp-login.php HTTP/1.1" 302 - "http://www.xxx.net/wp-login.php?redirect_to=http%3A%2F%2Fwww.xxx.net%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:03 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

173.193.4.135 - - [16/Oct/2011:02:41:05 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:05 -0500] "GET /wp-admin/ HTTP/1.1" 200 33987 "http://www.xxx.net/wp-login.php?redirect_to=http%3A%2F%2Fwww.xxx.net%2Fwp-admin%2F&reauth=1" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-admin/load-styles.php?c=1&dir=ltr&load=dashboard,plugin-install,global,wp-admin&ver=8e77e2d8a0596495034b9c96abb95f68 HTTP/1.1" 200 18828 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 200 464 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-content/plugins/secure-wordpress/css/wsd_sw_styles.css?ver=3.2.1 HTTP/1.1" 200 5378 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-includes/js/thickbox/thickbox.css?ver=20090514 HTTP/1.1" 200 3864 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 200 308 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-content/plugins/secure-wordpress/js/json.js?ver=3.2.1 HTTP/1.1" 200 14410 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd.js?ver=3.2.1 HTTP/1.1" 200 25676 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-content/plugins/secure-wordpress/js/md5.js?ver=3.2.1 HTTP/1.1" 200 6603 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd_scripts.js?ver=3.2.1 HTTP/1.1" 200 242 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 200 417 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:06 -0500] "GET /wp-admin/load-scripts.php?c=1&load=jquery,utils&ver=fb5c271ac01e8186b23ece33d5ce4961 HTTP/1.1" 200 35721 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-admin/images/generic.png HTTP/1.1" 200 3580 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-includes/images/blank.gif HTTP/1.1" 200 43 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /?resource=secure_wp.gif HTTP/1.1" 200 106 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-admin/images/media-button-image.gif?ver=20100531 HTTP/1.1" 200 206 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color,wp-ajax-response,wp-lists,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-resizable,quicktags,jquery-query,admin-comments,jquery-ui-sortable,postbox,dashboard,thickbox,plugin-install,media-upload&ver=bd8fcbe46a9f3c5a70cacd336ead667d HTTP/1.1" 200 37713 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-admin/images/media-button-video.gif?ver=20100531 HTTP/1.1" 200 139 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:07 -0500] "GET /wp-admin/images/media-button-music.gif?ver=20100531 HTTP/1.1" 200 205 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/media-button-other.gif?ver=20100531 HTTP/1.1" 200 245 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/wpspin_light.gif HTTP/1.1" 200 2193 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/menu-shadow.png HTTP/1.1" 200 131 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/menu.png?ver=20100531 HTTP/1.1" 200 12527 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/menu-arrow-frame.png HTTP/1.1" 200 564 "http://www.xxx.net/wp-admin/load-styles.php?c=1&dir=ltr&load=dashboard,plugin-install,global,wp-admin&ver=8e77e2d8a0596495034b9c96abb95f68" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/arrows-dark.png HTTP/1.1" 200 495 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:08 -0500] "GET /wp-admin/images/arrows.png HTTP/1.1" 200 494 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:09 -0500] "GET /wp-admin/images/wp-logo.png?ver=20110504 HTTP/1.1" 200 849 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:09 -0500] "GET /wp-admin/images/white-grad.png HTTP/1.1" 200 210 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:09 -0500] "GET /wp-admin/images/icons32.png?ver=20100531 HTTP/1.1" 200 14649 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:09 -0500] "GET /wp-includes/js/thickbox/loadingAnimation.gif HTTP/1.1" 200 5886 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:10 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:09 -0500] "GET /wp-admin/index-extra.php?jax=dashboard_incoming_links HTTP/1.1" 200 253 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:10 -0500] "GET /wp-admin/index-extra.php?jax=dashboard_primary HTTP/1.1" 200 1785 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:10 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:10 -0500] "GET /wp-admin/index-extra.php?jax=dashboard_secondary HTTP/1.1" 200 2678 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:11 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

173.193.4.135 - - [16/Oct/2011:02:41:12 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/secure-wordpress/css/wsd_sw_styles.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-admin/load-styles.php?c=1&dir=ltr&load=theme-editor,global,wp-admin&ver=1af15474be1d586967e9de35707267a1 HTTP/1.1" 200 17126 "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/secure-wordpress/js/json.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/secure-wordpress/js/md5.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd_scripts.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:13 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:12 -0500] "GET /wp-admin/theme-editor.php HTTP/1.1" 200 81803 "http://www.xxx.net/wp-admin/" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:15 -0500] "GET /wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color&ver=7d903dfc1d58d3c10544b01c2fc61931 HTTP/1.1" 200 3866 "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:15 -0500] "GET /wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme HTTP/1.1" 200 30520 "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:16 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:16 -0500] "GET /wp-content/plugins/secure-wordpress/css/wsd_sw_styles.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:16 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:16 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:16 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-content/plugins/secure-wordpress/js/md5.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd_scripts.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-content/plugins/secure-wordpress/js/json.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:17 -0500] "GET /wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color&ver=7d903dfc1d58d3c10544b01c2fc61931 HTTP/1.1" 200 3866 "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:21 -0500] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 284 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:21 -0500] "POST /wp-admin/theme-editor.php HTTP/1.1" 302 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:21 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:22 -0500] "GET /wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074 HTTP/1.1" 200 33754 "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11xxx%2Findex.php&theme=Twenty+Eleven%2Ftwenty11xxx&dir=theme" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

173.193.4.135 - - [16/Oct/2011:02:41:22 -0500] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "PHP/5.2.17"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/secure-wordpress/css/wsd_sw_styles.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/secure-wordpress/js/md5.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/secure-wordpress/js/json.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/secure-wordpress/js/sw_wsd_scripts.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:23 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/xxxx241/public_html/wp-content/themes/twenty11xxx/index.php&theme=Twenty+Eleven%2Ftwenty11xxx&a=te&scrollto=1074" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

2.88.154.165 - - [16/Oct/2011:02:41:25 -0500] "GET / HTTP/1.1" 200 3668 "-" "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

Virtual Private Servers

A virtual private server is one that is partitioned equally with its own section and the unit is acting like it owns the whole server. This is less expensive than dedicated server but more flexibility and functionality than the shared server. It is perfectly fit for business or person who has experienced rapid growth, heavy website traffic and running difficult application. It serves the bridge between the shared servers and the dedicated servers. Virtual server has limited processor time, space disk and RAM.

Dedicated Servers

Dedicated servers mean you are renting the whole physcial server for you to use it exclusinvely. So you have the whole computer. By this, you don’t have to share resources with the other websites. Renting and maintaining the server may cost up to 200$ and more. But even though it is that expensive, you can still have the full power to control the server, especially controlling the root access and the dedicated administration. In choosing this type of server you should check around all the providers and see what you get for your access plan. The most important thing is to make sure you know whats included and whats not included. The dedicated server si your machine so you are responsible for updating it and restoring it if it gets hacked. But each service provider has different rules, terms and conditions when it comes to whats included and whats not included.

Cheapest domains

In the world of internet, domain names are used to identify your IP address. And this are used in URLs to located the web page you want to visit for example yahoo.com , youtube.com.

In making your own domain name, it should be unique, short and easy to remember so that online users will never be confused with some similar names. Sometimes you can notice that after “.com” there is still another suffix added like “.us, .uk ...”. They indicate the location of the domain.

.com, .org, .net, .co are some of the common domain names that are commonly visited by online users. And also these are the cheapest domain names online. In buying domain names online, you should have to be patient in searching for the domain name and be sure that your domain name will identify the purpose of your site. Cheapest domains are found in Asia specifically in New Zealand and in Australia which only cost $15 per year. Like ours

.com.au domains for example can only be bought in Australia by Australians for a 2 year period (minimum). We have the cheapest .com.au domains at only $12.50 per year.

the future of SEO

Its along way through 2011 now and there is still a bit to go but the big G does alot to help itself to the top of its own rankings but is there anything that a humble SEO can do?

If you look at the top 10 of alot of searches on google these days and you will find that many of the the spots are filled with their own products and businesses. If it is not direct ownership then it is through very big brand names like Amazon. What hope does the small player have in 2011 or 2012?

If I run a small business selling some small product like say targetted clothing then have a look at the results here.

7 for all

You have no hope of being at the top of the rankings. They are flooded. But if your customers were say in Europe but still looked at Google.com then you might have a better chance.

7 for all europe

So there is a much better chance for getting a better spot in google if you are absolutely not obsessed with local USA searches or local USA traffic.

So one part of 2012 will be to have a look at your business model and see where is the traffic coming from and does it stay around.

Unfortunately most USA businesses will not ship overseas. So Change you site around a bit for the special overseas visitor.... even go crazy and offer some sort of shipping overseas.

the US$ is low at the moment. Make the most of the international traffic. Go out now and find out how to ship to the other side of the world. go and look at how other businesses do it.

All is not lost you just have to think outside the box while doing your SEO work.

When the goal posts move dont sit back and complain think...and think hard... What happened when cars started on the roads? I can bet you all the people in the horse industry and the carriage industry started to complain about the big bad Ford. Isnt that what we are doing today about Google? what about the blacksmiths doing horse shoes? If it had been me I would have started to use the metal for the shoes to repair things on cars... maybe learn to weld? What about all the shops where you could develop film? They have all gone. In my highstreet there used to be many offering 1hour turn around. the only one that survived went online and prints those fancy photo albumns. he also now sells telescopes, batteries, replacement parts, cameras and videos etc. He is not out of business yet but he is not driving a ferrari. If your business model is dying because Google has released Panda v 2.5 then think of other options. Google will come with Panda v 9999. Dont cling to the hope that cars will die out and horses will be back!

SEO 2012 will be about finding a new angle. Spamming Google to death with backlinks WILL NOT GET YOU ABOVE THE FOLD! dont bother trying. Wikipedia, You Tube, Ebay and Amazon are the only ones allowed above the fold......and of course............the premium Adwords. So go and think out of the box , in the mean time walk around the streets looking for those $100 Google vouchers!

What a mess up

We all know that people in certain positions prepare 2 speeches in advance. A YES speech and a NO Speech. We also can guess that the newspapers do it as well. this is especially true in the race to be first in Google News and be the first to be a viral content contender but you have to be really stupid to publish both the yes story and the no story at the same time. Sure you win the race to be in Google news first but you also get alot of headlines you probably dont want.

Have a look what Hobo found - well he found it second but he emailed me first so he gets the link in the race for Google news domination.

Amada Knox guilty and innocent at the same time!

Anyway we were not first to be on Google News and we are not trying to get our stories syndicated or even trying to be first but when I find something as funny as that I cant help but to write about it.

WHP

Hold the WordPress hackers back

We are not saying we have found the perfect solution but after adding these WordPress Plugins to our sites and our clients we have been able to be hack free now for a month. That’s not bad for just on 300 sites. It does take a bit of effort to roll it out to them all. Maybe we can work on a plugin to do it in future?

The idea with this method is to not make WordPress so obvious. WordPress by default loves to give out your login id! So that needs to be hidden. Then to stop the brute force password guessing you need some plugins.

Anyway with the bulk of the sites I was talking about we have added the following plugins (amongst others of course!)

- Secure WordPress - This cleans

Secure WordPress beefs up the security of your WordPress installation by removing error information on login pages, adds index.html to plugin directories, hides the WordPress version and much more.
Removes error-information on login-page
Adds index.php plugin-directory (virtual)
Removes the wp-version, except in admin-area
Removes Really Simple Discovery
Removes Windows Live Writer

- Limit Login Attempts

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on

However that is not enough.

Ontop of that you need to do the following:

NOT use ADMIN as your login.
Create a new user. Lets say ABC.
Login as ABC.
Go to the ABC user profile.
Under the name section there is a field there called “Display name publically as” – then a drop down. That drop down is populated by mixing the fields above. BUT DO NOT CHOOSE THE “Nickname”. That field is the one that you login with. The reason for this is that the hackers then know straight away what your login name is – so then all they need to do is get the password.
The go back and DELETE your ADMIN user. You cant have it lying around. Even as a publisher. You don’t want the WordPress hackers to get in at all. While deleting the ADMIN account you have to be careful because you can accidently delete all your posts. There is however an option to move them to the new user you created. So do that.
Finally and as you know…. Back it all up. Create a cron job to back up the database daily/weekly. The files and plugins don’t change that often so only back those up after you have made structural changes.

Good luck and lets see how long we can keep in front of the hackers.

another wordpress hack

This is what 2 clients had this morning -

HACKED BY RAMZI NULL & NED NULL TUNISIA HACKER

it is almost getting to the point where you have to ask whether it is worth having WordPress or not? It is so big and so popular it is the big target. Everytime there is a solution for a particular hack they find another way. Well thats business and thats what they do.

Here are the logs from this latest attack so you can see and even adding all the plugins that are recommended the simplest solution is to only allow 1 ip address to access youe wp_admin.php file as thats the most common attack these days besides FTP where you are leaving the

197.1.100.195 - - [13/Sep/2011:08:26:43 -0500] "GET /wp-login.php HTTP/1.1" 200 2261 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:26:53 -0500] "GET /wp-admin/css/login.css?ver=20110610 HTTP/1.1" 200 2156 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:26:53 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 200 39648 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:26:38 -0500] "GET / HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:53 -0500] "GET /wp-admin/images/logo-login.png HTTP/1.1" 200 8891 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:53 -0500] "GET /wp-admin/images/button-grad.png HTTP/1.1" 200 243 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:53 -0500] "GET /wp-admin/images/white-grad.png HTTP/1.1" 200 210 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:57 -0500] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 284 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:57 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:57 -0500] "POST /wp-login.php HTTP/1.1" 302 - "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:27:58 -0500] "GET /wp-admin/ HTTP/1.1" 200 44492 "http://xxxxxxxxx.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-content/plugins/exec-php/css/admin.css?ver=3.2.1 HTTP/1.1" 200 360 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 200 308 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 200 464 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-includes/js/thickbox/thickbox.css?ver=20090514 HTTP/1.1" 200 3864 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-admin/load-styles.php?c=1&dir=ltr&load=dashboard,plugin-install,global,wp-admin&ver=8e77e2d8a0596495034b9c96abb95f68 HTTP/1.1" 200 18828 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-content/plugins/exec-php/js/common.js?ver=3.2.1 HTTP/1.1" 200 404 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:06 -0500] "GET /wp-admin/load-scripts.php?c=1&load=sack,jquery,utils&ver=f9e1dc7c83360d6e5f74acc686e690a5 HTTP/1.1" 200 36818 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:07 -0500] "GET /wp-content/plugins/exec-php/js/admin.js?ver=3.2.1 HTTP/1.1" 200 3012 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:07 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 200 417 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:08 -0500] "GET /wp-content/plugins/google-analytics-dashboard/js/gad_main.js?ver=3.0 HTTP/1.1" 200 3587 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/menu.png?ver=20100531 HTTP/1.1" 200 12527 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/menu-shadow.png HTTP/1.1" 200 131 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/menu-arrow-frame.png HTTP/1.1" 200 564 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/arrows-dark.png HTTP/1.1" 200 495 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/generic.png HTTP/1.1" 200 3580 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/arrows.png HTTP/1.1" 200 494 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /?resource=secure_wp.gif HTTP/1.1" 200 106 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-includes/images/blank.gif HTTP/1.1" 200 43 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:32 -0500] "GET /wp-admin/images/wp-logo.png?ver=20110504 HTTP/1.1" 200 849 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:33 -0500] "GET /wp-admin/images/icons32.png?ver=20100531 HTTP/1.1" 200 14649 "http://www.xxxxxxxxx.com/wp-admin/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:41 -0500] "GET /wp-admin/load-styles.php?c=1&dir=ltr&load=theme-editor,global,wp-admin&ver=1af15474be1d586967e9de35707267a1 HTTP/1.1" 200 17126 "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:38 -0500] "GET /wp-admin/theme-editor.php HTTP/1.1" 200 85259 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:51 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:51 -0500] "GET /wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme HTTP/1.1" 200 33963 "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:56 -0500] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 - "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:57 -0500] "GET /wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color&ver=7d903dfc1d58d3c10544b01c2fc61931 HTTP/1.1" 200 3866 "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:28:59 -0500] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 284 "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:00 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:05 -0500] "POST /wp-admin/theme-editor.php HTTP/1.1" 302 - "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:06 -0500] "GET /wp-admin/theme-editor.php?file=/home/beach11/public_html/wp-content/themes/twentyeleven/index.php&theme=Twenty+Eleven&a=te&scrollto=0 HTTP/1.1" 200 31354 "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwentyeleven%2Findex.php&theme=Twenty+Eleven&dir=theme" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:15 -0500] "GET / HTTP/1.1" 200 102 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:17 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:08:29:13 -0500] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 - "http://www.xxxxxxxxx.com/wp-admin/theme-editor.php?file=/home/beach11/public_html/wp-content/themes/twentyeleven/index.php&theme=Twenty+Eleven&a=te&scrollto=0" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:09:11:33 -0500] "GET / HTTP/1.1" 200 102 "http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.xxxxxxxxx.com%2F&h=GAQDNwlkfAQAAwxhSs1AcfZftLQkaO-dpI0mi4F0O3-Ugqg" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:09:11:34 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:09:25:19 -0500] "GET / HTTP/1.1" 200 102 "http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.xxxxxxxxx.com%2F&h=XAQAx8UgiAQDyZi_x4lo9Yir4ixNIfqpiFWWNUTCTj4E9KA" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

197.1.100.195 - - [13/Sep/2011:09:25:30 -0500] "GET /favicon.ico HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

door wide open!

One more wordpress hack

Sorry I forgot to say yesterday that another site also got hacked and you should watch out for them of course playing with your theme as thats the weakest link and DONT forget to look in the 404.php file as they will have proboly messed with that as well here is an example of the code in the 404.php hack.

<title>Hacked By Silent_Hell</title>

<img src="http://blog.klikislam.com/wp-content/uploads/2010/10/solusi-bagi-yang-webnya-dihack.gif" >
Hacked 
By 
Silent_Hell
Url

: WwW.FaCeBooK.Com/SiLEnT.HeLl95
 ContacT
Me :

<a href="mailto:py8@live.fr">Silent95@9.Cn</a>

GrEetz To
: All TuNiSiaN HaCKeR

WordPress Twentyeleven theme hack via akismet

EDIT - See the comment section as Aksimet came and left a good explanation as to why this blogpost was wrong - sorry

Ok - I have not blogged much lately but thats because I have not had much to say - now at the request of my client I have decided to put this up.

One of my clients sites got hacked from what looks like akismet.

It was a new site with very little in it because it was only built 2 days ago. It was indexed by Google pretty quickly due to some SEO fancy footwork but thats not the story.

Cleaning the site was simply a matter of putting the old index.php back and then removing all the wordpress signatures and chaning the theme directory and adding a whole bunch of security plugins that you can get all the way down to the tinfoil hat.. but the culprit seems to be a backdoor JS Akismet hack. So that plugin was disabled.

Here are the logs

92.253.84.230 - - [22/Aug/2011:07:12:47 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:12:47 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:12:47 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:12:47 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:12:48 -0500] "GET /wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color&ver=7d903dfc1d58d3c10544b01c2fc61931 HTTP/1.1" 200 3866 "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:21 -0500] "GET /wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme HTTP/1.1" 200 29588 "http://www.xxx.net/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:24 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:25 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:25 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:25 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:43 -0500] "GET /wp-admin/images/button-grad-active.png HTTP/1.1" 200 284 "http://www.xxx.net/wp-admin/css/colors-fresh.css?ver=20110703" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:43 -0500] "POST /wp-admin/theme-editor.php HTTP/1.1" 302 - "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:44 -0500] "GET /wp-admin/theme-editor.php?file=/home/sony241/public_html/wp-content/themes/twenty11YYY/index.php&theme=Twenty+Eleven%2Ftwenty11YYY&a=te&scrollto=99 HTTP/1.1" 200 29206 "http://www.xxx.net/wp-admin/theme-editor.php?file=%2Fthemes%2Ftwenty11YYY%2Findex.php&theme=Twenty+Eleven%2Ftwenty11YYY&dir=theme" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:46 -0500] "GET /wp-content/plugins/akismet/akismet.css?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/sony241/public_html/wp-content/themes/twenty11YYY/index.php&theme=Twenty+Eleven%2Ftwenty11YYY&a=te&scrollto=99" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:46 -0500] "GET /wp-admin/css/colors-fresh.css?ver=20110703 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/sony241/public_html/wp-content/themes/twenty11YYY/index.php&theme=Twenty+Eleven%2Ftwenty11YYY&a=te&scrollto=99" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:46 -0500] "GET /wp-includes/js/l10n.js?ver=20101110 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/sony241/public_html/wp-content/themes/twenty11YYY/index.php&theme=Twenty+Eleven%2Ftwenty11YYY&a=te&scrollto=99" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:46 -0500] "GET /wp-content/plugins/akismet/akismet.js?ver=3.2.1 HTTP/1.1" 304 - "http://www.xxx.net/wp-admin/theme-editor.php?file=/home/sony241/public_html/wp-content/themes/twenty11YYY/index.php&theme=Twenty+Eleven%2Ftwenty11YYY&a=te&scrollto=99" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

92.253.84.230 - - [22/Aug/2011:07:16:56 -0500] "GET / HTTP/1.1" 200 1455 "-" "Mozilla/5.0 (Windows NT 6.0; rv:6.0) Gecko/20100101 Firefox/6.0"

217.162.28.98 - - [22/Aug/2011:07:17:34 -0500] "GET / HTTP/1.0" 200 1455 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

And here are the contents of the index.php that was edited

<html dir="rtl">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta http-equiv="Content-Language" content="ar-jo">
<title>Hacked by FreeZoM TeaM</title>
<meta name="keywords" content="FreeZoM TeaM,Karezma,Prime virus">
<meta name="description" content="FreeZoM TeaM,Karezma,Prime virus">
</head>
<body topmargin="0" leftmargin="0" rightmargin="0" bottommargin="0" marginwidth="0" marginheight="0" link="#FF0000" vlink="#FF0000" alink="#FF0000" text="#FFFFFF" bgcolor="#000000">
<p align="center"><b><span lang="en-us"><font size="4">Hacked By
<font color="#FF0000">FreeZoM </font>TeaM</font></span></b></p>
<p align="center">
<img border="0" src="http://www5.0zz0.com/2011/08/21/09/664775110.jpg" width="500" height="300"></p>
<p align="center"><span lang="en-us"><font size="4"><b>KaReZmA ||| Prime virus</b></font></span></p>
<p align="center">&nbsp;</p>
<p align="center"><span lang="en-us"><font size="4"><b>Contact Prime :
<a href="mailto:L-1@hotmail.com">L-1@hotmail.com</a></b></font></span></p>
<p align="center"><span lang="en-us"><font size="4"><b>Contact karezma : </b>
</font></span><b><span lang="en-us"><font size="4">
<a href="mailto:t2marvelm@yahoo.com">t2marvelm@yahoo.com</a></font></span></b></p>
<p align="center">&nbsp;</p>
<P style="MARGIN-BOTTOM: -10px" align=center><embed width="1" height="1" src="http://www.youtube.com/v/CCxrR7GfXZI&autoplay=1"></P>
</body>
</html>
Obviously to hide the identity I have changed some text to xxx and some to yyy.
Hope this help you.
WHP

What a crazy month

What a crazy month for one of our client sites that got sandboxed. It is lucky this client is a good freind and actually a best friend because I would not believe it if ti came from someone else. Anyway back In July his site got some sort of google Sandbox penalty, it went from the 20-30 mark for his keyword down to the 600+ range. Not like some others you hear about on the net that get kicked out of the index all together. So his site was still ranking for its .com name and also for its EMD (exact match domain) keywords, but it was not a perfect name as all those cost thousands but it did have his target key words in it. So after doing link building in July something happened. Then he was sandboxed as I said and the position went to the 600+ range. Then about 1 month ago for 4 days his site went to number 10-11. The only reason he noticed was the massive jump in hits and sales via adsense. Then pop he was back down agin. Then this week he was back in the top 10 for 2 days then pop. Now during all this time he has done no promotion of the site. He gave up on it thinking it was sanboxed forever.

So where to next? Will it come back to the top 10 or not? Stay tuned and we will bring you more news if something happens but until he stays in the top 10-30 he is not going to spend any time on it.

WHP

Domain Hosting

Affiliate post update

Following up on the affiliate site post we have looked into it and have also done alot of reading but the reading has posed more questions than answers. Could it be that our clients website is not linking out enough? Yes this topic has come up again.Does linking out help your Google Love?
If only we knew the answer and maybe we can run some tests to give it a try but it is really hard to play by the rules "build it unique and they will come" (including Google) does not really apply. too many websites play by the rules but are nowhere.

WHP

Website Hosting

Affiliate website to the top of google?

Can affiliate only websites get to the top of Google? Can they stay there? We are doing some reaserch into it because when you look at websites for sale so many are traffic pumped affiliate sites which push affiliate sales and duplicate content. How is that those sites dont burned to the ground by Google? We have a client who has a totally honest totally unique content wesite selling his own product and it got sandboxed and has been there for months.... how does that work when all these affiliate and sales sites sit at the top of Google? There are so many inconsistencies.

WHP

Website Hosting

What should I write about

Sometimes it is hard to think of topics to write about. Many bloggers say you have to keep feeding Google to keep the Google love. Lately however we have lost the love from Google so this post is to feed Google and not really add that much value to the internet community. What I can offer is that when this blog went live Google had it indexed within 5 minutes. These days however it can take hours before being indexed. Maybe it is because I have nothing to say?

WHP

Website Hosting

Forum promotion

One of our clients did an experiment for fun a few months ago after one of our blog posts. That experiment took a no named website, made a forum and an auto blog that generated a few thousand posts. Out of that came 500 inbound links, an Alexa rank of 300k, 700 unique visitors a day but what can you use that for? The Page Rank has not been update so we have no idea what it is. But what should happen next? Adsense? Some other targetted advertising? What can the site be used for? Well he is open for ideas and he is not saying what it is! So he is oging to run some of the ideas and will report back through us.

WHP

Website Hosting

Is an autoblog a good idea?

Should we turn this blog into an Auto Blog? Should we just go and get an Rss feed from some obscure location or language have it translated (incorrectly) and post it here? Will that generate the traffic? And if it does is it the traffic we really want? What do you want to do with the traffic? Do you want people to hang off every word you write as if you are a journalist or do you want to sell them something? Or are you writing for the sake of it like this entry?

Whatever the reasons make sure you know who the audience is as why you want them to go to your site and then make sure the message gets through.

WHP

Website Hosting

Adding Value to blog posts

How can you write a blog post that adds value to the internet community when nobody is following? How can you come up with the next viral post? There is so much pressure out there to perform on blogs. There are so many blogs coming on line each day but the amount of people reading is dropping as people are blogged out and spending the time on You tube and other such sites. We have no magic solution and dont post that often. We try and only post when we have something interesting to say. Some of our most popular posts on this blog are actually posts designed to help. So they are very specific. We draw alot of our inspiration from our clients support questions. how to backup... various different error messages.. etc.

So dont chase the big fish. Try and get some slow and steady traffic from the long tail and then on a specific post dealing with a specific topic then add some targetted traffic from one of many affiliate sources.

WHP

Website Hosting

focussed link bulding

If you every try to research link building on the internet you will end up spending a whole lot of time reading and reading. You will also end up following links to programs and plugins that someone swears is the best there is. By spidering your way through web pages you will end up with 20 new applications and 20 new plugins for wordpress that you will have to buy for $20 each. At the same time you will also see what other people say they are doing to make money on the internet. This will result in you thinking of 20 other projects to begin – you may even go as far as suddenly registering a whole lot of must have Exact Match Domains in money making niches.

Just remember be aware, that whilst it is fine to suddenly have a whole lot of new projects, just try and complete the ones you started. You still have to get backlinks and there are a few shortcuts but the work still has to be done.

So don't jump around creating 20 different projects because that's then 20 times as much link building you need to do.

Stay focused!!!

Website Hosting

Google Speeding Fine

To get to the top of the search engines you need backlinks – everyone knows that – but it is hard work- everyone knows that as well. So there is a massive industry out there now creating autoblogs, link wheels and automated backlinking software. There are even companies out there offering 50,000 backlinks for $50. It is all very tempting. There are a couple of things to be aware of – many of these are get rich quick schemes for the people who have made the software not you. So many of them have 1 page that you need to scroll for 25 minutes to get to the bottom of after reading 100 spun referrals from “ John Smith”. It is all very frustrating.

You might actually stumble upon one system that seems to work. Then before long the word is out and everyone is using the same method – then by magic it doesn't seem to work anymore. So the crowd moves onto the next one.

The warning here is that if you stumble upon something that works – keep it to yourself. If it seems to work too well then you might end up in the Google Sandbox – a speeding ticket!

So if you find the secret sauce then becareful… Is the proof of secret sauce being in a Google Sandbox. Is that the next marketing technique…” you wont find this product in the SERPS because it works so well we are all Sandboxed”

Website Hosting

test for twitter changes

Gee the chnges to twitter make it hard to test the tweets... sorry for this

Sand leaking out of Google Sandbox?

Holidays have been upon us and as a result the blogging died off a bit. One of the good things with the holidays is I don't get a chance to run the analytic tools we use every 5 mins. My holiday is always in a location where computers are rare and the internet simply does not exist.

So it is great to come back from holidays and get a screenshot from one of our clients showing that they are coming back out of the Google sandbox from the MayDay update. So they track 20 odd words where they WERE in the top 20 for most of them back in May - but all were in the top 100. Since the May update they had to change the settings to cover the top 1000 where there was nothing. However some of the slightly longer tail words are back on the screen at 60 and 250. These 2 words came back in the last 2 days. What an exciting screenshot that was to have in my mailbox when I got back.

Just for the record the reason we think that the site was sandboxed was mainly because of duplicate content. ½ the content was duplicate before they joined us and heard about what duplicate content is. Since that time back in December 2009 all new content has been unique. Also since May there has only been a very small amount of link building done to target other keywords (in case that was the reason) it made no difference. Also back in May the sites homepage was changed around a bit to see if it was an internal linking issues.

Finally no new content has been added and no old content has been changed since May. This site lost 90% of its traffic overnight and then was not worth the effort of rewriting.

So is this the start of a recovery? Has the rain washed some of the sand out of the Google sandbox?

WHP
Web Hosting

opera Mini 5.1 nearly working on a Blackberry Bold

I wrote about the terrible trouble I am having with my BlackBerry and Opera in this thread Opera Mini crashing my blackberry Bold but I was in the middle of writing some good news but then it happened again.

I am not going to write about all the troubles I have been having with my BlackBerry and opera mini 5.0 again as you can read it above. However the last time I used it and it crashed it offered version 5.1!!! Wooooohoooo… guess what it went for about a week before crashing totally to the point where I have had to reinstall it. A few days ago it half crashed but a reboot fixed it.

I thought that in its self was a major breakthrough and I was in the process of preparing to praise Opera for fixing the bug but then it happened again. Let me also say that I use Opera like I do my main computer and have about 5 different tabs open. I also ask one tab to load then move onto the next and the next. By the time I have done that 4-6 times the first has completed loading. So yes I run it hard but it should not freeze up.

It has gone from freezing a couple of times a day to once this week (but I have been on holidays so it does not get the work out it used to).

hmmmmm

WHP
Web Hosting

Blackberry Bold crashes with Opera Mini 5

I have a Blackberry Bold 9000 and decided a few weeks ago to upgrade my opera version 4 to version 5. I have always used Opera instead of the default Blackberry browser because of the way it renders certain pages. I was attracted to the tabbing functionality of Mini 5 as - well thats how I work on my main computer. I always have multiple tabs open and have never had any issues with Opera. That was until the new version was installed. Since then it has been a nightmare.

After my first crash I started to use the My opera syncronisation services which has saved me inputting all my bookmarks more than once. So every crash I get now all I need to do is reinstall the product and allow the syncronisation to put all my bookmarks back.

So whats happening with Mini 5 and why am I writing here instead of surfing the forums to find answers?

Well I have done all the above and at time of writing there were no answers and the odd guess was not necessarily my problem.

My problems are

1. “White screen” – Like Microsofts Blue Screen of Death – Opera has found their own but it is the “white screen of death”. The only difference between the 2 is that Microsoft actually provides a dump on the screen so you can work out whats wrong if you take a picture of that screen or memorise the error message. With Opera Mini 5 it is 100% white or a dirty white or a shade of greay depending on how you want to describe it. Eitherway it provides no valuable information as to whats gone wrong. How have I been getting this? Well sometimes on some pages it just refuses to load and freezes the program. I can get out and back to normal Blackberry functions but I cant reboot Opera. Even pulling the battery out does not help. Nothing does. The only thing to do is reinstall. I have had this particular one about 3 times. Or once every second or 3rd day.
2. Menu Freezing. I then get a different error where the only menu item I can get into is the URL bar. I cannot get into book marks or move from one tab to another. So whilst I can still use the browser for this tab only I can only manually type addresses. Once again taking the battery out etc does not work. This can happen a couple of times a day.

The great thing is that I don't pay for data usage so I don't need to worry about downloadiong the 500k a couple of times day.

The reason I am putting up with it is because I am trying to get to the bottom of it so I can find a solution. I do like the tab functionality as well. But by the end of this week if I cant find an answer anywhere on the net then I will go back to Mini 4 until I read about a patch or something. Right now it would be nice to just get some acknowledgement.

UPDATE: The new version 5.1 is more stable - see here -> opera mini 5.1 Blackberry not freezing

WHP
Web Hosting

Google ranking plummet

One of our clients got hit by the Google May-Day ratings plummet. You can read all over the web about the May-Day algorithm improvement. The aim was to improve the quality of the results (no shit Sherlock!) and this was done by attacking duplicate content issues and the long tail.

Those 2 are pretty easy to understand BUT our client also got hit on the short tail – even the 2 words he was targeting. Lets make up an example to protect the innocent – his words were “fast cars” where he ranked number 2. Now he is not in the top 1000… so why the drop? If he was good enough to get to number 2 then he should still be good enough to get into the top 1000?

Is there another penalty in play? Duplicate content? Malware? Something else?

Well it might take a while but we will follow his road to recovery because his site is absolutely not an ecommerce site nor is it a spam site nor is it filled with adsense or bad material.

WHP
Web Hosting

Crocodile catches and eats an Eagle.

One of our clients got one of those one in a million shots when a Crocodile attacked and killed a sea Eagle!

Well we didnt believe it either but take a look at their fishing blog.

Crocodile and Eagle

Enjoy.

Paid directories for Dofollow links

Google makes it quite clear that you are not allowed to pay for links. We all know that. You are allowed however to pay for directory submissions where there is editorial control and the directories are not full of all the undesirable websites. Business.com was one of these that everyone knows. There are also about 20-30 that we typically register all our SEO clients for but not all at once. You don't want a speeding fine from Google. I will not list them all here because some of them are not picked up by other SEOs.

I will however say that this is one of the ones we use - V7N Directory - that is not on everyone’s radar but it gets enough attention to be in the top 20 but not the top 5. So there you have it I gave away one of the less obvious paid directories.

On top of the 20-30 general ones there are about the same again niche specific directories.

One of the ways of telling if the directory is “good” is to check its Page Rank. You can generally forget about anything below a PR4. Often if Google gives a penalty to a directory it drops its Page Rank from say 6 to 3. So we ignore all the PR3 and below. For niche directories this does not apply as it is often hard to get the high Page Rank when you are so specialized. There are also sites out there that have lists of directories and their Page Rank. So if you are not sure then search because a directory can go bad if it is sold. By looking at old lists you can see what its Page Rank was previously.

Only pay if……

Regardless of what directory it is the purpose of this post is to make sure you don't hand over money to be put in a category that is not indexed! You are not going to get any direct traffic from this directory anyway – you are only doing it for the dofollow link. So why would you do it if that category has never been crawled by Google? If they have never been there then you are not going to get the credit. Do you follow?

If your category is not indexed then don't pay regardless of which directory it is!

Ontop of that we don't submit to directories where the category we are going get listed in has not been cached by Google in the last month. If Google only visits your category every few months then put your money elsewhere!

If your category has a cached date in Google of older than a month then put your money elsewhere.

For some directories you cannot be 100% sure where you will end up… so there is a bit of a gamble in. Have fun with paid directories but don't throw your money away.

WHP
http://www.webhostingplan.com.au/blog Web Hosting Plans

Other Do Follow Blogs

Well there are a few other blogs out there that allow the dofollow. But like ours they are not for spammers. It is quite simple add value with you comments and you will get rewarded. There are no easy links of any value. Put some effort into your blog comments and you will be rewarded.
Here is a list that we liked of do follow blogs so maybe you can follow our advice and get rewarded by the search engines and the blog owners.

WHP
http://www.webhostingplan.com.au/blog Web Hosting Plans

Free SEO advice!

There are so many SEO blogs out there and if you read them all, threw away the rubbish and picked up the best of everything out there you then might have a clue about what works in SEO land. But really we could fill this blog with all the standard stuff like get links, optimize your page, descriptions etc but we (and everyone else) are not going to put out our hot tips of what works today on an open blog. Even if you hire an SEO you are not necessarily going to learn all the tricks because you could then just do it yourself. Some places like SEO Book where you pay to be a member you will get 90% of the information you need, but let’s be honest if we knew that by getting a link with xyz text from xyz site was the secret ingredient, then everyone would go and get links from there and then 5 minutes later all the “bad areas” of the internet would have polluted the source and destroyed the value.

Why would we or anyone else give out that information on an open blog?

There are a lot of tips out there the building blocks and if you don't have those right then the secret sauce won’t help. That's where all those free guides do come in handy but they are all just a copy and paste of each. Maybe we should do it as well?

If you want to get to the top then you need to pay or work really really hard and have the ability to filter out the noise. You will also need to read the 100,000 SEO blogs and hope that by reading between the lines you can learn a secret or 2. Most blogs are writing to sell something and to stand out you need to say a bit more than your neighbor but you can’t give away the secrets – not that there are any anyway. Most blogs are still pushing ideas that don't work anymore. At least that's what we see from the comment spam we get!

Move on it is 2010.

WHP
http://www.webhostingplan.com.au/blog Web Hosting Plans

Web Hosting Plans – blog Its all about the web

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Related Reading:

Sponsor

Pages

Categories

Blogroll

Archives