Sponsored by NuSphere - PHP Software for PHP Application Developers - On Sale This Week for $100



Go Back   PHP-Editors > Web Hosting > Dedicated Servers

Dedicated Servers The place to talk about Dedicated Servers

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2006-07-21, 09:29 AM
Junior Member
 
Join Date: Jul 2006
Posts: 3
netagency is on a distinguished road
Thumbs down Very Bad experience with sitesouth.com

Here is the issue:
On the 22nd of June, around 6pm (Ukrainian time) our server dissapeared, no pings or any other type of connection was available. We tried to communicate with sitesouth via trouble-ticket system, but nobody answered, so we called them on the phone. Person, who picked up the phone there seemed to me drunk, but, because there was no other person to talk to, I asked him about our server. He answered that they will check what's wrong with it. In an hour or so I called again, cause all they answered us during this time (via trouble-ticket system) was a question about root password to our server and an idea that our server was hacked and that they are working on it. There was the same person on that side of the phone, who told me that they still don't know what's wrong with the server, after my question "when there might be some more information about the problem?" he said "in 10 minutes" and hung up the phone. I've called after 20 minutes of waiting and asked about the news, he said that there is no news and he is tired of talking to me, cause I'm calling every 10 minutes and it will not help our server. I was quiet surprised with such an answer and decided to wait as much as I can. In about 20 minutes after that speech the server was up again and we immediately expected it - there was nothing wrong with it, nobody hacked it and nobody even tried to... What is more in logs there was no information about any work that could be done by sitesouth techs.

After about 2 hours of working the server quit working normally again... This time we could ping it, but couldn't see any site on it, neither could we log to it via SSH. Of course, I've immediately called the support and got a chance to talk to the same man... He was very irritated but agreed that there is some problem and promised to find out what's wrong. We waited for a quiet long time and during this time there was some communication via trouble-ticket system. During this communication they were trying to tell us that our server actually was hacked, but at the same time no facts, that would prove their opinion they didn't show... Besides, on all our requests to use KVMoIP feature, which was ordered together with dedicated server, they were not telling NOTHING, although KVMoIP could show us the wholly complete picture of the problem and we also would be able to see whether there was a hack or not.

After 2 hours of our servers' inactivity I decided to call their support again to find out finally what's wrong and when will our server be up. As soon as "supporter" (the same one as it was before) have heard my voice he started to yell at me, saying that I'm abusing their telephone system and that he is going to cancel our account and will format our HDD-drives for that... I was shocked and just tried to explain that few calls during 7 hours or can't be an abuse, but he hung up on me. After that we decided not to call them and just communicate via trouble-ticket system, here is the result:

Andrey Rabeshko
Posted on 22 Jun 2006 11:18 AM my server is down.
old links to mrtg netgraf and remote reboot doesn't work.
Please do something.
Server ID: Server07
Server IPs: 63.247.79.155-.159 Additional IP's 63.247.79.168-.169

Anthony
Posted on 22 Jun 2006 11:36 AM Please provide the username and password so that we may log in to the server.

Andrey Rabeshko
Posted on 22 Jun 2006 11:37 AM root
stratosfera=21T

Anthony
Posted on 22 Jun 2006 12:17 PM It appears your server may have been hacked. Out techs are trying to recover the server.

Anthony
Posted on 22 Jun 2006 12:46 PM Your server is back online. You may want to verify all data is there.

Andrey Rabeshko
Posted on 22 Jun 2006 02:42 PM from what reasons you think that server was hacked ?
and please say me links to remote reboot and mrtg net graphs.

Andrey Rabeshko
Posted on 22 Jun 2006 02:42 PM i still can't login to server.

Eric
Posted on 22 Jun 2006 03:16 PM It appears the server password has changed since the last login. We are attempting to access the server.

We did find a number of files in the /tmp directory that normally indicate a server hack has occured. We did delete them at that time.

Andrey Rabeshko
Posted on 22 Jun 2006 03:18 PM please try to reboot(hard) it. i think that all will be ok after that.

Bob
Posted on 22 Jun 2006 03:48 PM Hello,

We shall have our NOC technician reboot the server and shall update you soon.

Regards,
Bob

Andrey Rabeshko
Posted on 22 Jun 2006 04:01 PM server down for a long time. maybe you can set up KVMoIP for me ? and i look it myself ?

Andrey Rabeshko
Posted on 22 Jun 2006 04:52 PM hello.
1.when i buy this server i get 1 hour of KVMoIP per month. I whan't to use it.
2.lot of files in temp directory are produced by my web server on it's normal operation. and doesn't mean that it's hacked.

i waiting for your answers. thanks

Michael George
Posted on 22 Jun 2006 04:55 PM Hello,

Our administration team is checking the issue. Please hold on and they will get back to you with the updates.

Regards,
Bob

Eric
Posted on 22 Jun 2006 04:55 PM As per our telehone conversation and several support and emails your server has been hacked.

Since we feel you have abused the support telephone line sytem we are terminating your account at this time. We will provide a full refund for the balance of your current term.

Andrey Rabeshko
Posted on 22 Jun 2006 05:04 PM we realy didn't want to abuse the support telephone line sytem. i think you should understand that we haver very important information on the sever and feel nervous for it destiny. please excuse us if we were wrong. we will not call any more, will speak only on support system. is any possibility to get our data and server back ?

Andrey Rabeshko
Posted on 22 Jun 2006 05:12 PM Ticket Opened by Customer
Reason Specified: please read it.

Eric
Posted on 22 Jun 2006 06:09 PM As we said, the server had been hacked. We do this for a living, we know what a hacked server is. The home directories we removed by the hacker. The hacker even logged in while one of the techs was on the server.

As per our previus post, you account is now terminated for abuse of the support system. A refund for the balance of the month will be issued.

Andrey Rabeshko
Posted on 23 Jun 2006 12:43 AM There were two HDD-drives on that server and we were doing cross-backup on them, probably the hacker didn't delete everything, we would really appreciate if you could give us an access to those drives, because it is critically important for us to save at least some data.

Anthony
Posted on 23 Jun 2006 12:54 AM My understanding is this server has been taken offline are reformatted already.

There is no way to verify this until 10:00 AM EST tomorrow morning.


Andrey Rabeshko
Posted on 23 Jun 2006 01:01 AM We really hope that it wasn't totally reformated in such a short period of time, please help us. We are ready to wait for that data till morning, but if it can be done earlier it would be really-really nice, you can keep our money, but please give us our data.

Andrey Rabeshko
Posted on 23 Jun 2006 12:28 PM Dear Sirs, I guess it's 10AM EST now and we are really looking for your help. Please tell us about the possibility to recover information that was on our server.

Anthony
Posted on 23 Jun 2006 08:39 PM As per our multiple support responses, emails and the numerous telephone calls, your server was hacked. All data outside the base operating system was removed from all drives by the hacker. Much of the data, of the core system, such as log files, were also deleted. Though we tried to restore data, there was none to be restored.

Once a server has been compromised we do not put the server back on the network. We will not risk attacks on other servers or networks. We reformat all hard drives with a low level format using a dedicated disk repair and formating system to make sure there is no data or files to be recovered by a hacker when the server is put on line. The erase and reformat on the system are DOD-5220 Government Erase compliant. I assure you there is no data to recover at that point.

Andrey Rabeshko
Posted on 24 Jun 2006 01:58 AM Can you explain why did you reformat all hard drives with low level format??? You could just reinstall the system and put it back, so we would recover our files ourselves, but you SPECIALLY have reformated the drives with low level, so nobody would be able to recover the information right? You did this just in case if we will get that server with a help of court, didn't you?
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 2006-07-21, 09:32 AM
Junior Member
 
Join Date: Jul 2006
Posts: 3
netagency is on a distinguished road
Thumbs down continuation

Andrey Rabeshko
Posted on 24 Jun 2006 01:58 AM Can you explain why did you reformat all hard drives with low level format??? You could just reinstall the system and put it back, so we would recover our files ourselves, but you SPECIALLY have reformated the drives with low level, so nobody would be able to recover the information right? You did this just in case if we will get that server with a help of court, didn't you?

Andrey Rabeshko
Posted on 24 Jun 2006 02:10 AM One more question: Why did you reformat the drives of OUR dedicated server (we have already payed for using it personally)? We didn't ask you about it, we asked you to give us KVMoIP, but you preffered to kill that server and all the info instead of giving us, as your clients a chance to recover it. Why? We are STILL YOUR CLIENTS yet, because you haven't done any refund, so you are responsible for that server. We are still waiting for our information back online and hope that it will happen really soon, otherwise we are going to use ALL methods to inform the internet-community about your "work" and also go for judicial enforcement against your company and personnel, that was involved in this outrageous case. So, you have just one chance to avoid judicial trial - give us back our information and we will take off our claims.

Michael George
Posted on 24 Jun 2006 06:53 AM As per posts here in the support desk, and multiple telephone conversations with you, your account was terminated for abuse of the support department. You are not our client. We will offer a refund for your unused time. Refunds are paid on the 5th of each month so they may be adjusted against any bandwidth over usage charges for the past month.

From our Terms of Service:

You, as a SiteSouth Subsciber, are solely responsible for the content stored on and served by your SiteSouth account. It is the Subscriber's sole responsibility to maintain off-site and local copies of their web server content or any information on a server. SiteSouth accepts no responsibilities, expressed or implied, for any data or information on a Subscriber's account or server(s) or network.

You, as a SiteSouth Subscriber, are solely responsible for the security of any and all content stored on and served by your SiteSouth account. It is the Subscriber's sole responsibility to maintain proper security of their web server(s), its content or any information on a server(s) or network. SiteSouth accepts no responsibilities, expressed or implied, for any form of security on a Subscriber's account or server(s) or network. You, as a SiteSouth Subscriber, are solely responsible for security compliance with any applicable law or third party contract that may require a minimum standard of internet or web server security.

SiteSouth reserves the right to terminate any account or service, without notice, at any time. SiteSouth reserves the right to suspend network access to any Subsciber if in the judgment of the SiteSouth network administrators the Subsciber's server is the source or target of the violation of any of the other terms of the AUP or for any other reason which SiteSouth chooses. If inappropriate activity is detected, all accounts of the Subsciber in question will be deactivated until an investigation is complete. Prior notification to the Subsciber is not assured. In extreme cases, law enforcement will be contacted regarding the activity. The Subsciber will not be credited for the time the Subsciber's machines were suspended.

Further from our Terms of Service: The parties therefore agree that in addition to any other remedies available hereunder, by law or otherwise, SiteSouth shall be entitled to an injunction or other equitable relief against any such continued breach by Subscriber of such obligations.

If you are trying to blackmail SiteSouth or attempt some type of "internet extortion" please keep in mind that we will use whatever means that are available to seek damages against you.

As has been stated in these support tickets and during many phone conversations, there is no data, your account has been terminated for abuse and you are not a client of SiteSouth.
Andrey Rabeshko

Posted on 25 Jun 2006 01:28 PM The only abusers here are YOU, because you are abusing your clients, besides you are liers and anybody, who knows server-side even a little, can see it from this troubleticket. I have understood that you are liers and cheaters from the second conversation on the phone, but thought that it was just some drunk technician, who couldn't even give me a good lie, but now I see that it's your company's policy and I feel pitty that my server was bought by you together with other servers from Tenshade. As I said before your lies and abuses to me, as your client will be punished as much as it is possible and you are the only culprit for this.

Andrey Rabeshko
Posted on 05 Jul 2006 05:33 PM Ticket Opened by Customer
Reason Specified: messages from you
Andrey Rabeshko

Posted on 05 Jul 2006 05:35 PM Why am I still getting these messages from you???


This is a notice that your invoice 2729 has been generated for services
by sitesouth.com on 07/02/2006.

-------------------------
Total Due: $165.00 Due Date: 07/10/2006
-------------------------

Your payment method is: CC Batch

We will attempt to process your credit card shortly and you will see a
charge from sitesouth.com for this transaction.


The credit card you have on file (Visa-0993) will expire on (6/2006).

Please login and update your credit card information to prevent
disruption in your service.

BILLING INFORMATION: <<link removed>>

Username: andrey@atrace.com
Password: ******


when will you finally give me a refund?
Reply With Quote
  #3 (permalink)  
Old 2006-07-21, 09:34 AM
Junior Member
 
Join Date: Jul 2006
Posts: 3
netagency is on a distinguished road
Thumbs down here is continuation of this story:

As you remember sitesouth's message of terminating our service was this:
"Since we feel you have abused the support telephone line sytem we are terminating your account at this time. We will provide a full refund for the balance of your current term."

And here is the letter that we've got from them recently:


-------- Original Message --------
From: - Mon Jul 17 14:11:25 2006
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <info@sitesouth.com>
Delivered-To: andrey@atrace.com
Received: (qmail 98087 invoked by uid 0); 16 Jul 2006 18:01:19 -0000
Received: from unknown (HELO primary.sitesouth.com) (207.210.66.242) by
oasis.tviy.com.ua with SMTP; 16 Jul 2006 18:01:19 -0000
Received: from sites by primary.sitesouth.com with local (Exim 4.52) id
1G2AvL-0003Bj-Gt for andrey@atrace.com; Sun, 16 Jul 2006 14:00:59 -0400
To: andrey@atrace.com
Subject: [FBK-40900]: my server is down
MIME-Version: 1.0
From: Michael George <info@sitesouth.com>
X-Mailer: eSupport v2
Content-Type: multipart/alternative;
boundary="=_566147df8d7496d04ee1a3a54dc52f8d"
Message-ID: <j2icpn.lr946n@www.sitesouth.com>
Sender: <sites@primary.sitesouth.com>
Date: Sun, 16 Jul 2006 14:00:59 -0400
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - primary.sitesouth.com
X-AntiAbuse: Original Domain - atrace.com
X-AntiAbuse: Originator/Caller UID/GID - [32004 32002] / [47 12]
X-AntiAbuse: Sender Address Domain - sitesouth.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php index.php
X-Source-Dir: sitesouth.com:/public_html/support/admin



*my server is down*

As this was an unmanaged server our accounting department is preparing
to bill you for the additional hands on technical support. Our rate is
$120.00 per hour and you used 3 hours of support time.

Your refund for the month was $148.00. Your bill for remote support was
$360.00. You will have an outstanding balance due of $212.00. You should
receive the invoice on Monday or Tuesday.
Thank you,
SiteSouth

------------------------------------------------------------------------


Ticket ID: FBK-40900
Tracking URL: Click Here
<https://www.sitesouth.com/support/index.php?_a=tickets&_m=viewmain&emailre=andrey@at race.com&ticketkeyre=7340b038&_i=FBK-40900>


Department: TechSupport
Created On: 22 Jun 2006 11:18 AM
Last Update: 16 Jul 2006 03:59 AM
Status: Open
Reply With Quote
  #4 (permalink)  
Old 2006-11-18, 03:37 PM
Junior Member
 
Join Date: Nov 2006
Posts: 1
sitesouth is on a distinguished road
Default

Let me respond to this. It is really very simple.

The server was fully hacked and infected with 9 different viruses. 100% of the customers data had been deleted and replaced with some very vulgar post and nasty comments by the hacker. All log files had been deleted or replaced with gibberish. We ran a number of restore programs, none of which worked. It was clear there was no data left and the sever was completely infected. We told the customer this in multiple emails, support desk tickets and telephone calls.

I was not going to knowingly put a server with no customer data that had been hacked and infected server back on line.

We responded to his first support ticket within 18 minutes. We had 5 pages of communications in our support desk with this client. We had over 50 telephone calls within the first hour from this person. He knew there were techs working on his machine all this time.

We offered to ship the customer the drives if he wanted them. He was not satisfied with that offer. As the customer refused the drives and the server was not going back on line in it's present state we did our normal service on the drives which includes an erase and reformat on the system to DOD-5220 Government Erase compliant standards. We do this to all hard drives that are no longer installed and are being prepared to be reinstalled. It's a level of security we perform on all hard drives when they are reformatted.

We tried everything we could to resolve the issue. The account was finally terminated for abuse of the support system after this was explained several times in support tickets, emails and phone calls he still continued calling us every 3 to 5 minutes for over another hour. Finally when he sent us this, along with other threats: "We are still waiting for our information back on line and hope that it will happen really soon, otherwise we are going to use ALL methods to inform the internet-community about your "work" and also go for judicial enforcement against your company and personnel, that was involved in this outrageous case." we stopped communicating with him. He also sent highly edited support tickets and responses, as he has done in this thread, to his customers trying to make it look like we had just randomly reformatted his hard drives and had canceled his account for no reason, which was not the case.

We believe we did everything possible to help this client, we are not going to put a hacked infected machine with no other data on line, we offered the drives to the client, we offer backup services which the client choose not to use, nor did the client make his own backups. the client began abusing the support system, the client sent edited emails and support tickets to his clients, as he has done in this thread, trying to make it appear we randomly decided to format his data and closed his account. Clearly in the thread, he carried out his threat to try and make it look like we were not trying to provide any service or assistance.

There are two sides to this story. This is our experience of the events
Reply With Quote
  #5 (permalink)  
Old 2006-11-18, 06:17 PM
Senior Member
 
Join Date: Jul 2006
Location: Prague, Czech Republic
Posts: 193
vladimir_cz is on a distinguished road
Send a message via ICQ to vladimir_cz Send a message via MSN to vladimir_cz Send a message via Yahoo to vladimir_cz Send a message via Skype™ to vladimir_cz
Default

Quote:
Originally Posted by sitesouth View Post
Let me respond to this. It is really very simple.

The server was fully hacked and infected with 9 different viruses. 100% of the customers data had been deleted and replaced with some very vulgar post and nasty comments by the hacker. All log files had been deleted or replaced with gibberish. We ran a number of restore programs, none of which worked. It was clear there was no data left and the sever was completely infected.
About hack and virus: Welcome to linux world (if need, I can explain, why I think so).
About data save: do you known about dump/restore? a lot of providers make dump every 3-4 hours. this is free for clients. and client can ask restore files/folders, if need.
__________________
Thank you. Vladimir, Czech Republic.
http://www.smartwebco.com/
I'm looking for job.
Reply With Quote
  #6 (permalink)  
Old 2006-11-20, 02:36 PM
Junior Member
 
Join Date: Nov 2006
Posts: 1
jor_el is on a distinguished road
Default

Even if sitesouth is a bunch of crooks, you should have kept a copy of your website off-server somewhere. That way, if the site really was hacked, at least you wouldn't have lost everything. Same if sitesouth is run by scammers; at least you'd have a copy of your website. Just a bit of friendly advice. Live and learn.
Reply With Quote
Must read Review for Serious PHP Developers


NuSphere PhpED 5.5 : The Staff of php-editors.com recently spent a few days working with NuSphere PhpED 5.5 (a popular PHP IDE) and NuCoder 2.0 (a PHP Encoding Utility), read up on all the details.

Sponsored Links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -5. The time now is 09:35 PM.


Powered by vBulletin® Version 3.7.2
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
LinkBacks Enabled by vBSEO 3.1.0
© Copyright 2003-2008 www.php-editors.com. The ultimate PHP Editor and PHP IDE site.