3

I just did a google search for my own site, using site:mysite.com, and I got some very weird results.

There's this subdomain that doesn't seems to exist on my FTP, and it's filling 10 pages of google results with spam, here's a picture:

russian spam subdomain linking to vk network

There's nothing unusual in my DNS Zone Editor.

I've contacted my host and they are looking into it. But, how can this be possible in the first place? What should I look for if I want to understand how this happened and prevent such things from happening?

5
  • You're using free hosting from 000webhost, and free host many times inject anything without your permission. Your subdomain is still exist, and only your hosting provider will solve your problem.
    – Goyllo
    Jan 22, 2017 at 14:20
  • I'm using paid host from Hostinger, where did you see 000webhost? Jan 22, 2017 at 14:21
  • I see this popup message in your subdomain , "this website is using 000webhost", and it also contain redirect ads as well. You will see that only first time, if you click on second time you will not going to see that popup. So use ignite mode in your browser(for chrome use ctrl+shift+N) and search on Google "ophohoaz" and click on first result and then you will see that popup. Look's like someone hacked your website.
    – Goyllo
    Jan 22, 2017 at 15:15
  • 3
    It looks like it was a server-side security breach from my hosting. They deleted the spammy subdomain, but I hope they act in the root of the problem and understand how that breach was possible and fix it... I can only ask and hope. Jan 22, 2017 at 15:51
  • You can verify the subdomain in search console (eg, via DNS verification, since you can't put a file there) and submit a site-removal request for it to clean this up a bit faster. Jan 24, 2017 at 19:58

1 Answer 1

1

When this happens it is more often than not due to a hijacked or poisoned DNS zone file. Don't trust the zone file editor in your hosting panel as if the server has been compromised then this won't show you anything, instead run a manual DNS query for the offending domain name and check what the authoritative dns server is. If it is not your server then you need to get in touch with your domain name registrar, if it is the correct DNS server then you need to manually check the zone file in the shell (may need your hosting provider to do this for you). Not having a sub domain exist on your FTP directory means absolutely nothing as sites with different sub domains can exist on entirely separate servers with no hassle at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.