The offshoot of the John Kerry Forum appears to have been hijacked

[JMDEM]

I need a bit of help here and some advice. The offshoot of the John Kerry forum -- www.commongroundcommonsense.org -- appears to have been hijacked sometime early Sunday morning (Nov. 5th). When I attempt to get to that site, a completely different site now appears -- one that contains links to sites supposedly containing "keywords" of the original URL request -- e.g., there is a list of links to sites discussing "common ground". There is also, of course, links to sites offering home loans and other BS like that.

I tried this on two different computers so I am pretty sure it is not spyware doing this.

I am not sure of the mechanics of how this is done, or how it can be fixed. Is it malicious (from a political dirty tricks sense)? Any advice would be appreciated.

[salin]

1. at the bottom of the page is a 'why am I seeing this website' link

clicked it - and it was a whois email - subject line had website name and said status: expired.

Innocent guess would be that the domain name expired.

[JMDEM]

2. That is impossible

The site was up and running just a few hours ago - we are a small but very tightly linked community, and this could not happen without any notice.

[salin]

3. you said it was an offshoot of another site...

any possibility that whoever set up the offshoot, has not been involved in the community - and wasn't aware it was still thriving, and thus didn't pay attention to when the site might expire?

That said, were I a part of the community, I too would be a bit freaked out.

[JMDEM]

16. We only know the person who owns the site as "Michael"

At least that's all I know. But he seems to be an active part of the site. Unless he took a 2 week trip and forgot... But I think there are back-up people who would know how to take care of things.

[zalinda]

4. From whois

Domain ID:D105091788-LROR
Domain Name:COMMONGROUNDCOMMONSENSE.ORG
Created On:04-Nov-2004 17:58:55 UTC
Last Updated On:05-Nov-2006 13:46:38 UTC
Expiration Date:04-Nov-2007 17:58:55 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:9620B77CCEBA55FD

So, it may have been highjacked.

zalinda

[JMDEM]

6. Now I'm a bit confused

So it did seem to go haywire exactly when its expiration date came up?

Please decipher this a bit for me. Thanks!

[rox63]

5. I am a regular on that site

And I couldn't reach it this morning either. That community just hit it's 2-year birthday this weekend. So I suspect the admin forgot to renew the domain name. I'm bummed. :(

[JMDEM]

13. You wouldn't happen to be

the blogger with the name Rox63 on CGCS, would you? :)

[rox63]

18. Yes I would!

Who are you there?

[Keefer]

7. Try it again...

I just clicked your link. It's working for me. Try emptying your cache and/or cookies and reboot.

[JMDEM]

8. Nope -- doesn't work for me.

I cleared my cache, deleted all cookies, and rebooted, and still get the bogus page.

[Keefer]

9. My bad.

The main page is fine, but links FROM the main page, like the blog, are expired.

Example:

http://www.commongroundcommonsense.org/forums/index.php?automodule=blog

[salin]

11. all I get is a bunch of ads for mortgages

not a discussion forum.

[Greyhound]

10. Domain has expired, Gotta keep that registration current. D'oh! n/t

[salin]

12. read that too - but go upthread to Zalinda

it isn't supposed to expire until 07, according to WHOIS.

[JMDEM]

14. But I am wondering if the domain name

got scooped for one year because the domain owner failed to renew it exactly on time?

[JMDEM]

15. I know there are a lot of people from that forum who also post here

If anyone has news about what happened to CGCS, please keep the rest of us informed. I am starting to get very worried about this situation.

[IDemo]

17. I posted there for awhile after 11/04

I was 'vote4kerry' on the old Kerry forum. Had lunch with one of the other CGCS regulars a few months ago.

Sad to see it go, if the domain name has indeed expired.

[JMDEM]

19. I just did a search on Google about this situation

and it appears that hacking is the most probable situation. Hacking of the ISP server.

[IDemo]

20. The 'TechEmail' listed under WHOIS is [e-mail]

might want to give that a try..

Or, there is telephone and address info as well: http://www.whois.net/whois_new.cgi?d=commongroundcommonsense.org

[karendc]

21. We have left phone messages

with the CGCS folks, Mike and Sandra. Will let you know if, when we hear anything.

[JMDEM]

22. Okay -- thanks a lot

This timing is beyond belief. It has to have been hacked.

[IDemo]

23. Maybe 'snuffysmith' will post the news here, too. ;)

[JMDEM]

24. I wonder how many other hacking attempts were made on other sites?

Common Ground Common Sense (CGCS) has (unfortunately) dwindled from a relatively large involvement right after the 2004 elections, because it was a direct offshoot of www.johnkerry.com. In fact, it was the only direct offshoot. Now it is fairly small.

I am wondering how many other hack attempts were made on other sites? Due to its small size and limited admin staff, CGCS may have been very vulnerable.

The one advantage of a smaller site is that you pretty well know the personalities of the other posters, so you know what to expect from them. If some news item comes out and is being discussed, we will hear from far far far left, mildly left, middle of the roaders, and even a couple of right wingers on the board. (Plus the Libertarian viewpoint). We accept our 2 or 3 right wingers as deviant children, but don't kick them off because they don't try to screw up the works.

[JMDEM]

25. Okay -- Situation Resolved -- Site back up

It was not a conspiracy. The owner had an automatic credit card billing situation going on, the card expired, and the owner forgot to notify the ISP of the new expiration date on the replacement card. So... the ISP just shut it down. Kinda makes you wonder about that ISP though... I would think they would give some warning first.