Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them.

Sometimes it shows my actual website, but a couple of minutes after requesting it, when I revisit my site it shows a parking page (from parkingcrew.net).

Me and my host have checked my nameservers, and DNS settings, and have made sure it's all set correctly. I have also checked my .htaccess files for as far as my sites have it, and I checked my php pages, but I can't seem to find anything wrong with them. I have also checked on different networks (locations) to make sure it's not my home network's fault.

Maybe someone could check it out for me to see what the problem is, or maybe has had this problem before.

Two of the websites are: http://serifd.nl and http://turnbroekjemetnaam.nl. The ip-address they're (supposed to be) running on is 91.220.37.56.

share|improve this question
    
What webserver are you running? –  Lucas Kauffman Apr 8 '12 at 5:04

2 Answers 2

DNS is horribly broken. You say you checked nameservers and DNS settings -- I'd love to hear the description of what you found, because I'd call it an atrocious mess.

serifd.nl has nameservers ns1.vlasveldmedia.nl and ns2.vlasveldmedia.nl. When querying those nameservers, I'm redirected to ns1.nns365.com and ns2.nns365.com. Nevermind that such a redirect is already broken.

So, to find ns1.nns365.com or ns2.nns365.com's IP address so I can ask them about serifd.nl, I have to check the namservers of nns365.com. But guess what, they're ns1.nns365.com and ns2.nns365.com, the very machines I was trying to find in the first place. Boom.

Let's look at turnbroekjemetnaam.nl. Well, the nameservers are ns1.knothhosting05.nl and ns2.knothhosting05.nl. But guess what? They direct me to ns1.vlasveldmedia.nl and ns2.vlasveldmedia.nl. And it's the same nightmare all over again.

Oh, and here's the really fun part. When I ask 95.211.9.46 or 95.211.9.41 (ns1.nns365.com and ns2.nns365.com) what nameservers to use to resolve serifd.nl, they tell me 95.211.9.46 and 95.211.9.41. And they respond authoritatively.

serifd.nl.              3600    IN      NS      ns2.nns365.com.
serifd.nl.              3600    IN      NS      ns1.nns365.com.
ns2.nns365.com.         3600    IN      NS      95.211.9.46.
ns1.nns365.com.         3600    IN      NS      95.211.9.41.

Great, they each tell me to ask the very same nameservers I just asked.

And, just for fun, they throw in this incomprehensible garbledygook:

95.211.9.41.            3600    IN      A       50.57.205.238
95.211.9.46.            3600    IN      A       50.57.205.238

I can't even imagine what that means.

If I ask them what IP to use directly, they say:

serifd.nl.              3600    IN      A       50.57.205.238

So if I did manage to get an answer from them, it'd be wrong anyway. Your DNS is a mess.

share|improve this answer
    
Wow, that clears things up. Thanks alot for checking. By checking the DNS I made sure the settings were correct (ns1.knothhosting05.nl, etc) at my domain registrar. But I guess there's something misconfigured at my hosting which redirects them to old custom nameservers (which apparantly redirect to another nameserver). Now to find out where to fix this. Thanks alot! –  Jesse Vlasveld Apr 7 '12 at 12:44
    
That doesn't help, since ns1.knothhosting05.nl and ns2.knothhosting05.nl just direct me to ns1.vlasveldmedia.nl and ns2.vlasveldmedia.nl. The knotthosting05.nl nameservers are wrong to direct me there, and the vlasveldmedia.nl nameservers are wrong for authoritatively answering for a domain they are no longer associated with. If you fix the knothhosting05.nl nameservers, 95% of the problem will go away. –  David Schwartz Apr 7 '12 at 13:02

Some additional findings:

dig @ns1.vlasveldmedia.nl serifd.nl ns

;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;serifd.nl.         IN  NS

;; ANSWER SECTION:
ns2.nns365.com.     3600    IN  NS  95.211.9.46.
serifd.nl.      3600    IN  NS  ns1.nns365.com.
ns1.nns365.com.     3600    IN  NS  95.211.9.41.
serifd.nl.      3600    IN  NS  ns2.nns365.com.

;; ADDITIONAL SECTION:
ns2.nns365.com.     3600    IN  A   50.57.205.238
95.211.9.41.        3600    IN  A   50.57.205.238
ns1.nns365.com.     3600    IN  A   50.57.205.238
95.211.9.46.        3600    IN  A   50.57.205.238

We have no recursion but the server adds additional data and glue information in it's answer. He knows who ns1.nns365.com and ns2.nns365.com are (while the delegation is broken for them as David stated). That looks either like a compromised dns database on this server or a poisoned cache. You should examine this server for security problems especially of your powerdns installation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.