Kent,
Might help you with this prick iSKORPiTX. He also ruined my site.
Check this out
Cpanel for the site of where e is hosting some details
https://mavi1.org:2083/login/
Also what I found strange is that he seems to be using a hosting service from Thailand.
https://www.mavi1.org / https://www.who.is/whois-org/ip-address/mavi1.org/
https://www.mavi1.org/forum
https://www.siyamiozkan.com.tr / https://www.who.is/whois-tr/ip-address/siyamiozkan.com.tr/
I am beginning to see that he is aware of how to exploit cpanel where then replaces all of the index.html or index.php with his own.
If I where to have 5 or 6 of the sites that he exploited I guess that the majority use cpanel https://www.cpanel.net/index.html.
This is just a hunch.
Regards
Greenspan
