I checked the zone-h database. http://www.zone-h.org/archive/notifier=T0xic http://www.zone-h.org/archive/notifier=T0xic It appears it's the usual mass deface

I checked the zone-h database. http://www.zone-h.org/archive/notifier=T0xic http://www.zone-h.org/archive/notifier=T0xic It appears it's the usual mass defacement, so they are probably exploiting a well-known vulnerability. You are not the only one, I checked for other domains hosted with webfaction.com (Which seems to be a re-seller hosting service using linode, I could be wrong): eyetraveldoc.com* themediashow.net* These were also defaced (these are using the same IP as yours), so there is a high chance that your hosting service is running a vulnerable kernel, service or the node you're on is. So notifying them and continuing from there would be a good start. *They have been restored, but a mirror is on zone-h