1

Over the weekend it looks like the DNS was hijacked on two of my domains.

My set up is I have the sites registered on 1and1.co.uk, with dns nameservers pointing to Hostgator in the US where the sites are hosted. I also had cloudflare CDN running on the sites (via hostgator cpanel).

My question is any ideas as to how this happened, and how I could either monitor it so I know if it occurs again, or strengthen the set up/service to minimise the risk.

History:

  • I received a ping from my site monitoring service that the sites were down.
  • When I checked the sites were up so I assumed it was local to the monitoring service
  • I received a ping last night the sites were up
  • When I checked, one site was redirecting to download-manual.com (and checking that URL now, the home page is not the same as the one I saw, so they too may have been hijacked/hacked)
  • The other site URL remained the same but had one of those standard site search pages which bounce you off to either phishing or paid for search sites

I notified Hostgator who told me Cloudflare or 1and1 were the issue. I removed cloudflare, and contacted both them and hostgator, and am awaiting a response, but am not holding my breath.

Is this common? I've never heard of this or come across this before. It's pretty scary that this can happen so easily.

Appreciate any input.

**Update: I've now spoken to support at 1and1, Hostgator, and Cloudflare, and each one claims it has nothing to do with them, and must be one of the others. Larry, curly, moe.

Improve this question

3 Answers 3

Reset to default
2

Why do you think it's DNS hijacking? And if you believe it's DNS hijacking, why would you suspect your CDN provider, registrar, or webhost of being at fault? If your DNS requests are being hijacked, then it'd be your ISP's fault (or whoever operates the DNS servers your network is configured to use). This seems highly unlikely.

You're not providing enough information for us to go on. Have you checked the actual DNS settings on your domain? Have you checked the DNS response you get back from your ISP's DNS servers? If these both point to your web server then this has nothing to do with DNS.

The most likely scenario is that your site or hosting account was compromised, and it has nothing to do with DNS hijacking—especially as you're actually being "redirected" to another URL (instead of just showing different content on your site). Analyze the HTTP communication when you request a page on your domain to see how you're being redirected. Figure out what's going on first before you start pointing fingers.

Improve this answer
0

Since CloudFlare wouldn't be hosting your DNS if you activated via an integration, there would be nothing on our end that would cause this. The only possibility we can think of is the IP got changed in some way (not via CloudFlare, again, because we wouldn't host your DNS zone files or server ip settings).

Improve this answer
-2

I got same problem and I was able to resolve the issue. Change your Cloudflare account or change your DNS management.

Improve this answer
1
  • 1
    One line answers are not sufficient. Can you edit this answer to elaborate on what changes to the Cloudflare account or DNS are needed?
    – Stephen Ostermiller ♦
    Commented Jan 24, 2017 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.