Hmmm I had the hosting company run a rootkit whatsy thing to check for a worm and nada.
Buggered if I can find where they are running the redirect from. Is it possible to not affect the timestamp of a file? The one compromised one I found had no recent modification date that would have given an instant clue.
This is getting annoying. What’s the weather like in Instanbul this time of year?