What happened to gearslutz?

[Xonetacular]

I think we're safe here

[Xonetacular]

Hmm it was up for like 20 minutes this morning and buggy now it is reverted back porn spam. I read something on the forums about either a spammer exploiting a security vulnerability or some DNS issues that were supposedly fixed and the the changes were propagating the web.

edit: clearing my DNS cache kind of helped but site is still buggy (windows users: ipconfig /flushdns)

[Cook]

Notice that it says adult guitar lessons. lol

Sometimes you need to learn to give a good strumming

[Dj Kave]

"Granny dating site"

lmao

[Xonetacular]

funny at work I was able to get on after clearing my dns cache but it is still messed up for me at home regardless of what I do


details on what happened from fb:

Gearslutz.com
What happened?

Gearslutz moved web hosts back in June 2011 and the migration went well. During this migration an error was made when the name servers where configured. One of the nameservers was miss spelt and in normal circumstances this would have not caused any issues other than slightly less resilience in the dns infrastructure.
On the 1st of march 2012 a hacker noticed this domain exploit and registered the domain name miss spelling. They used this domain miss spelling to redirect some users to a special branded web page that makes money off page clicks. Our web host corrected the miss spelling as soon as it was indentified at 7am gmt.

Why was this not resolved sooner?
The hacker used a domain name with a "time to live" (ttl) of one day. This ttl means that any forum users who were redirects to this special branded web page would have it cached for 24 hours.

Was I hacked?
The aim of this hack was to make money from the hyper link clicks rather than compromise end users pcs and macs. However we have scanned this web page our selves and confirmed that no viruses on the site or branded web site.

Will this happen again?
No. The changes weve made are permanent and will stop this from happening again. We will also be moving our domain registration to our web hosting provider so any future updates will be handled automatically to prevent any further typos.

Summary, its a boring wait until the DNS propagates

Will be AOK tomorrow am..

Jules

[dripstep]

I just hope that it doesn't follow us here. I don't want to spread the infection.

When I visit DJTT, I ALWAYS wear a condom or two.

[mostapha]

They probably use the same hosting company as DJF.