Comments on: Breaking News: WordPress Hacked with holasionweb on Go Daddy!

By: Website Defender

Website Defender — Wed, 09 Mar 2011 10:23:30 +0000

[...] you were safe in the forest this spring? As reported yesterday, and now reinforced by wpsecuritylock.com, the godaddy malware infections continue to grow, and now seems to be [...]

By: WordPress Sites on GoDaddy, Bluehost Hacked

WordPress Sites on GoDaddy, Bluehost Hacked — Tue, 09 Nov 2010 20:44:44 +0000

[...] you are a user of self-installed WordPress on Godaddy, Bluehost, Media Temple and other services, there is a decent chance that your site has been hacked and, worse yet, you may not know about [...]

By: These Freaking Hackers Are Really Ticking Me Off :: The Lonely Conservative

These Freaking Hackers Are Really Ticking Me Off :: The Lonely Conservative — Wed, 07 Jul 2010 22:35:08 +0000

[...] WP Security Lock has been on top of this issue and has plenty of information if you’re experiencing a problem with your site. Their latest post for the May 11-12 hack can be found here. [...]

By: Jim Johnson,CRS

Jim Johnson,CRS — Sun, 23 May 2010 02:17:13 +0000

Thanks for fixing my blog!

By: mailforlen

mailforlen — Thu, 20 May 2010 07:50:11 +0000

Breaking News: WordPress Hacked with holasionweb on Go Daddy! | WPSecurityLock: Tags: no_tag Posted by: mailforlen http://bit.ly/dxPeEm

By: Week 19 in Review – 2010 | Infosec Events

Week 19 in Review – 2010 | Infosec Events — Mon, 17 May 2010 06:27:37 +0000

[...] Breaking News: WordPress Hacked with holasionweb on Go Daddy! – wpsecuritylock.com [...]

By: Joao B L Moraes

Joao B L Moraes — Sat, 15 May 2010 23:33:22 +0000

RT @WPSecurityLock: WordPress hacked with holasionweb on Go Daddy today! Please check your sites now! http://goo.gl/fb/dryVK #WordPress

By: Michelle

Michelle — Fri, 14 May 2010 17:11:24 +0000

He also tried using this plugin too

wp-content/plugins/wp-adserve/adclick.php?id=-1+union+select+0x6875616B

By: Michelle

Michelle — Fri, 14 May 2010 16:41:07 +0000

I just had someone try and log in using the backend with an IP 188.72.213.44!

The webpage was my domain followed by /wp-content/plugins/wordspew/wordspew-rss.php?id=-998877+UNION+SELECT+0,1,0x6875616B,3,4,5--

and the Offending Parameter: id = -998877 UNION SELECT 0,1,0x6875616B,3,4,5--

I don't have the wordspew plugin.

By: David Libovitzi

David Libovitzi — Fri, 14 May 2010 03:31:36 +0000

http://help.godaddy.com/article/510

The reason that file had the code on it is because the base64 code spreads to other php files.