Jesper

Thanks Chris

Yes, “Normal” meaning not like my site.

Not literally a duplicate. See this screenshot:

https://picasaweb.google.nl/lh/photo/qJUfnmxItyQidyr3x82nUw?feat=directlink

Chris,

At any rate, just curious, are we talking about these two sites, cause they don’t look ANYTHING like each other!

https://sekerziyafe.blogcu.com/
https://nijmegeneet.nl/

At this time:

The turkish site seems to be back to normal:

https://sekerziyafe.blogcu.com/

At this time:

18-10-2010 at 13:42

The turkish site seems to be back to normal:

https://sekerziyafe.blogcu.com/

What’s the hell going on?

James,

I understand it about the favicon. I’m using a CDN for my images. I’ve added your code to the .htacces file of my CDN (subdomain).

But I’m not seeing a 403 on the favicon file?

Thanks James,

I updated the .htacces

But I still see my favicon on:

https://sekerziyafe.blogcu.com/

Maybe it’s a cache issue?

James,

Thanks! Your latest code seems to do the trick!

I can tell (in firebug) all my files get a 403 status on the offending site.

Are there more issues I have to address?

James,

I’ve added your code like so:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https://(www\.)?blogcu\.com/ [NC]
RewriteRule \.(jpe?g|gif|png|css|js|xml)$ - [F]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Doe not seem to do the trick?

Thinkdeep,

Yesterday, I have disabled hotlinking on my server.

But, since yesterdy night it looks like the entire turkish site is down:

maindomain:
https://blogcu.com/

subdomain:
https://sekerziyafe.blogcu.com

Does this indicate that the problem is on their site?

Thanks,I’ll check!
I found, using fire bug, several URL’s in the resources from my site on the Turkish site. Several themes and plugin CSS-es are used and/or have a referal. For example:

Antwoordheadersbron bekijken
Date	Sun, 17 Oct 2010 13:13:28 GMT
Server	Apache
X-Pingback	https://nijmegeneet.nl/xmlrpc.php
Expires	Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified	Sun, 17 Oct 2010 13:13:29 GMT
Cache-Control	no-cache, must-revalidate, max-age=0
Pragma	no-cache
Keep-Alive	timeout=10, max=50
Connection	Keep-Alive
Transfer-Encoding	chunked
Content-Type	text/html; charset=UTF-8
Verzoekheadersbron bekijken
Host	nijmegeneet.nl
User-Agent	Mozilla/5.0 (Windows; U; Windows NT 6.1; nl; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept	text/css,*/*;q=0.1
Accept-Language	nl,en-us;q=0.7,en;q=0.3
Accept-Encoding	gzip,deflate
Accept-Charset	ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive	115
Connection	keep-alive
Referer	https://sekerziyafe.blogcu.com/
Cookie	__utma=15978665.1807316893.1277214311.1287247968.1287316242.251; __utmz=15978665.1286897139.234.40.utmcsr=feedburner|utmccn=Feed:%20NijmegenEet%20(Nijmegen%20Eet)|utmcmd=feed|utmcct=FeedBurner; wp-settings-1=hidetb%3D1%26editor%3Dtinymce%26imgsize%3Dthumbnail%26urlbutton%3Dfile%26align%3Dleft%26galfile%3D1%26galcols%3D2%26m0%3Dc%26m1%3Dc%26m2%3Dc%26m3%3Dc%26m4%3Dc%26m5%3Dc%26m6%3Do%26m7%3Dc%26m8%3Do%26m9%3Dc%26m10%3Do%26m11%3Dc%26galdesc%3D1%26m13%3Dc%26m14%3Dc; wp-settings-time-1=1287316018; wpgb_visit_last_php-https://www_google_nl=1281467032; wpgb_visit_last-https://www_google.nl=Tue%20Aug%2010%202010%2021%3A04%3A24%20GMT+0200; wpgb_visit_last_php-https://nijmegeneet_nl=1281467068; wpgb_visit_last-https://nijmegeneet_nl=Tue%20Aug%2010%202010%2021%3A02%3A47%20GMT+0200; wpgb_closed-https://nijmegeneet_nl=Tue%20Aug%2010%202010%2020%3A59%3A22%20GMT+0200; wp-settings-2=hidetb%3D1%26editor%3Dtinymce%26imgsize%3Dfull%26galfile%3D1%26galdesc%3D1%26m4%3Do%26m1%3Do%26m10%3Do%26urlbutton%3Dpost%26m6%3Do%26m2%3Do%26m14%3Do; wp-settings-time-2=1284057078; wp-settings-time-3=1285682825; wordpress_test_cookie=WP+Cookie+check; __utmc=15978665; wordpress_logged_in_7c2bfd4ce9c908612bb87c0449d58bcf=jesperpopma%7C1287490898%7C6335460f791b97c89790f5adec43bf2b

I contacted my host and they think my site is hacked. They say I should restore my files. But where to start in this case. Start with plugins, themefiles, upload files? or WordPress core files? Any sugestions? Where is most likely to get infected?

Samuel,

My site is not on wordpress.com, but it’s self hosted!

I’ve changed my theme-name and now the turkish site is without a theme:

https://sekerziyafe.blogcu.com/

But still there is a connection because When I load the Turkish site I see in my statusbar in firefox that it is also loading my site:

https://nijmegeneet.nl

So they must have acces to my server or embedded some code somewhere in my files?????

What to do?

I just tried the following:
I deleted my themes custom background images. Now the Turkisch site is effected by this, because all their background images are lost. So they must have some connection with our server.

Thanks for your reply.
No it is not possible that they use exactely the same theme. Because all the background images are mine. Also the favicon is mine. But I don’t see the same content either. But I’m receiving referral traffic from this site. And my site is found with Turkisch keywords, wich have no relations to my content.