3

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely different website at this sub domain. It seems to be some sort of gaming website that sells hardware as well. This sub domain does not show up in my cPanel and when I try to create the subdomain cpanel.example.com I get an error.

Update: I used a DNS zone editor to delete some A records that had been made to that subdomain. There were others including mail.example.net, webmail.example.net and whs.example.net all containing the same site. I have the issue of their existence solved, but I need to know if this is a breach in security. All of the subdomains seemed to have been named to purposely avoid suspicious. Does this sound like a breach in security?

Improve this question
9
  • Some web hosts and registrars do this automatically and I am not sure why. It is unwise. But I am not sure that it is a security risk by default, though I am sure it can be in some situations. – closetnoc Feb 9 '15 at 19:24
  • Could it be left behind from someone who previously owned the domain name? – Dylan Haynes Feb 9 '15 at 19:26
  • I seriously doubt it. This is fairly common. Unfortunately. – closetnoc Feb 9 '15 at 19:37
  • 1
    I assume the .com is a slip? – MrWhite Feb 9 '15 at 22:45
  • @DylanHaynes It would help to clarify what w3d asked. The A records should probably be CNAME records that point to your host, not the IP address as w3d pointed out. It's probably just an oversight in your hosting company's DNS Zone Template, which you should relay to their support team. – dan♦ Feb 10 '15 at 2:35
3

It is common for webhosts to direct both example.com/cpanel and cpanel.example.com to your cPanel (on port 80 - not secure - better to use cPanel via HTTPS on port 2083). However, it seems they might not have set up the redirection for the subdomain and instead it's simply defaulting to the IP address of your shared server. In which case it is likely returning the first defined virtualhost, which seems to be this "gaming website". The webhost should really make sure that the first "host" returns some default server page or something equally meaningless.

Access your site by its IP address and you'll probably get the same "gaming website".

The other subdomains you mention are again fairly standard, as closetnoc mentions, although webmail. should really direct to your webmail service - but I presume it does not?! In your case everything is probably all on the same server, so mail. is probably just an alias for your servers IP address. mail. is often used with email clients for your incoming/outgoing mailserver, but you can probably just use your domain name (however, this is again the insecure way).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.