I was Googling one of my domains (hosted on shared hosting) and found a webpage where it was list as Hacked Site, the list belonging to a certain national hacking group (the country they claim to belong is notorious for lot of international troubles, but the country, as such, has no accords in hacking World).
Only the root index page is public while rest of the data is protected by HTTP Authentication. Moreover, each page (in addition to logging by the cPanel) also has its own visit logging script which logs visit data to the DB and neither of the two logging mechanism show an unusual activity during the past few months. Also none of my files seem to have been affected or altered.
As of writing, I have blocked all access to most of the folders/data completely and changed passwords and username for the once not blocked. The domain is primarily used by us for testing and experimentation.
- Is this possibly a false claim? (There is very little to suggest an intrusion going through logs and state of the files, db etc.)
- How can I better diagnose the situation?
- Given that it is on hackers list, should I abandon the domain and/or host?