#Update: Apparently one or more of Godaddy’s load balancers have been compromised which is causing sporadic redirections to porn sites. Incident number is INC-5492776
Hi all,
I won’t name them yet, just in case it’s not their fault (but I really think it is), but my personal website is hosted with a company that doesn’t have the best reputation these days. A few days ago, I opened a page on my site and got redirected to a porn site. It only happened the once so I thought maybe I’d fat-fingered and opened some old dodgy page from my history. It happened again on the same computer earlier today, so I ran a check for malware and it came up negative.
Then it happened again a few hours later, loading a different page from the same site on a different computer.
None of my files appears to contain anything malicious. A few years ago one of my files did seem to get compromised, but the company assured me that it was nothing to do with them and I should just change my passwords (which were already very secure) 🙄
So I set an empty HTML page with a 5 second reload and opened it on a third computer with a different OS (Linux, instead of Windows). Sure enough, within about 20 minutes, I went back to check and it had redirected to the same porn site.
Do you guys have any advice? Have I overlooked anything that might indicate it’s not a server compromise?
—
Edit: I’ve now seen it happen via Tor Browser, so it can’t be an ISP issue. It redirects first to a numeric IP with my domain name (“DOM”) and page (“URI”) as query parameters, which then redirects to the porn site.
—
**Big edit: I’ve identified the issue:** The server is sporadically, and seemingly only once per originating IP address, returning a “302 Found” HTTP response instead of “200 OK”, along with a `location:` header which is redirecting the browser to a numeric IP address with my domain name and URI in the query string. This site then redirects the browser again to the porn site.
I’ve informed the host but it’s out of hours right now. It’ll be interesting to see what they have to say for themselves, particularly as they are planning scheduled maintenance early tomorrow morning.
—
**Update:** first response from host is to fob me with a generic email implying that it’s my files that have been compromised. “we do not expertise in web security” – well that’s reassuring.
—
**Another update:** It’s a shared host, so I tried using the plain IP address and also the reverse-DNS hostname. Both are exhibiting these redirects, so I think that definitively rules out my website and points the finger firmly at the server.
—
**Probably final update:** “We are aware of this problem, and **GoDaddy** has confirmed this is an ongoing issue by opening an internal incident report for Intermittent Redirects to Malicious Sites. Some customers using cPanel Shared and WebHosting Plus accounts have reported that they intermittently see a redirect to content other than their own.”
https://community.cloudflare.com/t/redirecting-to-unwanted-sites/445551/2
GoDaddy Incident: INC-5492776
View Reddit by wonkey_monkey – View Source