I recieved 1 defacement out of 10 sites I host. Server was win 2K, all services except essential ones are disabled, port 80 set as only port allowed for access. I show defacement came in from search engine scan repeatedly. Immediately after scan I open page, so this was not hard to track. I then searched logs and found NO posts, but did find a couple "/embed" tags. The only site defaced has 6 pages all HTML format. logs did not show entry to server other than the search engine. spygrup.mezarkabul.googlepages DOT com/ appears....along with the image img134.imageshack DOT us/img134/7387/turkiyeji9hq1wq9xy4mu0.gif signature is Hacked By Nið-DeLi

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/212/1906#1906