0

So if I go to my site without indicating the protocol, I'm taken to:

http://example.org/test.php

But if I go directly to:

https://example.org/test.php

I get a 404 back.

If I go to just:

https://example.org

I get a totally different site (a page about martial arts).

I went to the site via https not very long ago (maybe a week?) and it was fine.

This is a shared server, as I understand it, and I do not have shell access, so I'm limited to the site's CPanel to do any further investigations. But when I go to:

example.org:2083

I'm taken to https://example.org:2083, which, if someone has taken over the SSL port, could mean they have taken over the 2083 part as well (at least in my paranoid mind). I'm made more nervous by the fact that the cpanel login page at the above address looks very new (better, really) compared to the last time I went to it over the weekend.

It's possible that wires got crossed somewhere after a system update, but I don't want to put in my name username and password in case it's a phishing attempt.

Is there any way to know for sure without shell access to know for sure if someone has taken over?

If I look up the IP address for the host name, the IP address matches what I have on a phpinfo page I can get to over http. If I go to the IP address directly on port 2083, I get the same login mentioned above (new and and suspiciously nice). But the SSL cert shows as good when I go this route. So if that's the case (I know the IP is right, the cert checks out, and there isn't any DNS involved), is that enough to feel safe at that point of entry?

Finally, if I can safely log in via the IP, does anyone have any advice on where to check first on CPanel for why the SSL port is forwarding to a site on karate?

Thanks.

Improve this question

2 Answers 2

Reset to default
4

Here is what I think:

  1. The server administrator upgraded the shared web server (maybe just cPanel).
  2. Something broke, and now the martial arts vHost serves 0.0.0.0:443 (that is, any endpoint on port 443 on the server).

This is why the cPanel looks new and "suspiciously" nice.

I would contact the server administrator/service provider to confirm this, (and have them fix it)

Improve this answer
1
  • Thanks. This was my suspicion, but the site has had some prankish hacks before (as well as some major screw ups by the host provider), and as I'm not an admin for the site, I don't get much say in how to harden it beyond securing the web apps themselves. But I know just enough about servers in general , as well as the admins (and the host provider) for this site to know that if it can be fixed via cPanel, I can probably do it faster and save everyone else from a lot of back-and-forth.
    – Anthony
    Apr 5, 2012 at 11:25
1

It's likely a cPanel update has ruined everything. I suggest you call the shared hosting provider for support, as there isn't much you can do from your individual cPanel, they likely have to log into WHM (the administrative side of cPanel) and fix the issues.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .