Has my site been hacked?

Posted by sheckay on September 2, 2012 at 1:47am

I was looking into reports on my domain host. There's a list of requests (requested URL's) made to my domain. And saw one that looked strange. It was my domain's url with a "/?ref=BenimShopum.com" at the end (www.mysite.com//?ref=BenimShopum.com).
When I looked up benimshopum.com, it looks like some foreign site selling vulger prescription items.
So then I looked into content on my site. I don't see anything like this on there. When I search files, nothing shows up. But if you go to www.mysite.com//?ref=BenimShopum.com, that url functions.
Does anyone know what's happening?
Thanks in advance.

Comments

Did you happen to buy the

Posted by dekova on September 2, 2012 at 2:02am

Did you happen to buy the domain recently? It could be a leftover link exchange that you're seeing.

In any case, no... seeing that request come in doesn't mean your site was hacked and just about any query string appended to the url will work.

Try this:
www.mysite.com//?randomparam=randomvalue

Thank you Dekova. It's not a

Posted by sheckay on September 2, 2012 at 2:49am

Thank you Dekova. It's not a new domain, just a site that was redone on a newer version of Drupal.

I didn't mean to sound like I was overreacting, but I was looking at what I meantioned and other traffic coming from all over the world. I was wondering what in the world was going on. Of course this type of traffic may have been going on all along, I just wasn't examining the logs until I did the update of Drupal.

Thanks again.