LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   I am hacked? (https://www.linuxquestions.org/questions/linux-newbie-8/i-am-hacked-756801/)

Cartman89 09-21-2009 12:29 PM

I am hacked?
 
Somebody, i dont know who, hacked my external ip... when i am trying to get on my ip, 89.121.210.202 (i want to configure my router).. it directs me to a website (and after i looked good on it..its a ghost site...not 4 good)..what can i do? i want to configure my router,not to join on a site when i write in browser http://89.121.210.202

repo 09-21-2009 12:32 PM

Are you sure the IP is correct?
89.121.210.202 is from romtelecom
address: Garlei 1B sector 1 013721 Bucuresti Romania

If you are behind the router you want to configure, use the private IP

salmon913 09-21-2009 02:50 PM

use the local IP of the router on your network, not a public IP.

Cartman89 09-22-2009 12:40 AM

Quote:

Originally Posted by salmon913 (Post 3692041)
use the local IP of the router on your network, not a public IP.

and which should be the local IP of my router? i tried 10.0.1.67 ..it gives me error...so..dont know whats wrong

bharatlalgupta 09-22-2009 01:09 AM

https problem
 
i'm using multiple sites, on http
now i create certificate for https then i access my sites with diffrent name & virtual hosting. by default one first page is open with all virtual hosts name.

mrclisdue 09-22-2009 04:36 AM

*Often* the router address is something along the lines of 192.168.x.1 . What is the output of ifconfig?

cheers,

repo 09-22-2009 05:02 AM

Quote:

and which should be the local IP of my router? i tried 10.0.1.67 ..it gives me error...so..dont know whats wrong
Open a terminal
type
Code:

ifconfig
route -n

and post the output.


Is this on your local network at home?

Wim Sturkenboom 09-22-2009 05:36 AM

Quote:

Originally Posted by bharatlalgupta (Post 3692476)
i'm using multiple sites, on http
now i create certificate for https then i access my sites with diffrent name & virtual hosting. by default one first page is open with all virtual hosts name.

How does this help the topicstarter? Please start your own thread.

Cartman89 09-22-2009 06:19 AM

Quote:

Originally Posted by repo (Post 3692670)
Open a terminal
type
Code:

ifconfig
route -n

and post the output.


Is this on your local network at home?



eth0 Link encap:Ethernet HWaddr 00:0d:87:48:45:60
inet addr:10.0.1.67 Bcast:10.255.255.255 Mask:255.0.0.0
inet6 addr: fe80::20d:87ff:fe48:4560/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:634746 errors:0 dropped:0 overruns:0 frame:0
TX packets:101780 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:247108511 (247.1 MB) TX bytes:9927031 (9.9 MB)
Interrupt:19 Base address:0xd400

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8188 errors:0 dropped:0 overruns:0 frame:0
TX packets:8188 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:771328 (771.3 KB) TX bytes:771328 (771.3 KB)



Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 1 0 0 eth0
0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth0

First is ifconfig and second is route -n

manwithaplan 09-22-2009 06:27 AM

I'd open a terminal and issue this command:

Code:

curl -s http://checkip.dyndns.org/ | grep -o "[[:digit:].]\+"
This should print your Public IP to your console window. Now compare this to the address your thinking was hacked. If there different, then you know the outcome.

Try using a DynDNS service for IP forwarding. This way if your IP ever changes it can always be resolved with a name. And its free.

repo 09-22-2009 06:37 AM

Quote:

0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth0
Your router should be at
10.0.0.1

However
Are yu connecting to your router at your home network from your home network?
Or are you connecting to your router at your home network from your work or another place?

Cartman89 09-22-2009 06:42 AM

Quote:

Originally Posted by manwithaplan (Post 3692733)
I'd open a terminal and issue this command:

Code:

curl -s http://checkip.dyndns.org/ | grep -o "[[:digit:].]\+"
This should print your Public IP to your console window. Now compare this to the address your thinking was hacked. If there different, then you know the outcome.

Try using a DynDNS service for IP forwarding. This way if your IP ever changes it can always be resolved with a name. And its free.


curl -s http://checkip.dyndns.org/ | grep -o "[[:digit:].]\+"
89.121.210.202


i my ip isnt changing..is always this.. but i tried this..somebody hacked it..it connects me to a sports site :|

Cartman89 09-22-2009 06:44 AM

Quote:

Originally Posted by repo (Post 3692740)
Your router should be at
10.0.0.1

However
Are yu connecting to your router at your home network from your home network?
Or are you connecting to your router at your home network from your work or another place?

i tried 10.0.0.1 ..shit..it connects me to the site..showing how much i must pay at internet..download programs (for windows)..and how much i must pay at internet..or how much i payed... so..dunno

manwithaplan 09-22-2009 06:47 AM

Check your hosts file. See if there is any forwarding info. As repo suggested, configure the router with filtering. Also host your sites on the local ip range, if used for internel use only.

repo 09-22-2009 06:48 AM

What do you see when you type
127.0.0.1
in the browser ?

Is this your home network?


Perhaps there is a routing issue with your provider.
I would suggest to contact them.


All times are GMT -5. The time now is 06:19 AM.