Websites get hijacked by parking page

Question

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them.

Sometimes it shows my actual website, but a couple of minutes after requesting it, when I revisit my site it shows a parking page (from parkingcrew.net).

Me and my host have checked my nameservers, and DNS settings, and have made sure it's all set correctly. I have also checked my .htaccess files for as far as my sites have it, and I checked my php pages, but I can't seem to find anything wrong with them. I have also checked on different networks (locations) to make sure it's not my home network's fault.

Maybe someone could check it out for me to see what the problem is, or maybe has had this problem before.

Two of the websites are: http://serifd.nl and http://turnbroekjemetnaam.nl. The ip-address they're (supposed to be) running on is 91.220.37.56.

Answer 1

DNS is horribly broken. You say you checked nameservers and DNS settings -- I'd love to hear the description of what you found, because I'd call it an atrocious mess.

serifd.nl has nameservers ns1.vlasveldmedia.nl and ns2.vlasveldmedia.nl. When querying those nameservers, I'm redirected to ns1.nns365.com and ns2.nns365.com. Nevermind that such a redirect is already broken.

So, to find ns1.nns365.com or ns2.nns365.com's IP address so I can ask them about serifd.nl, I have to check the namservers of nns365.com. But guess what, they're ns1.nns365.com and ns2.nns365.com, the very machines I was trying to find in the first place. Boom.

Let's look at turnbroekjemetnaam.nl. Well, the nameservers are ns1.knothhosting05.nl and ns2.knothhosting05.nl. But guess what? They direct me to ns1.vlasveldmedia.nl and ns2.vlasveldmedia.nl. And it's the same nightmare all over again.

Oh, and here's the really fun part. When I ask 95.211.9.46 or 95.211.9.41 (ns1.nns365.com and ns2.nns365.com) what nameservers to use to resolve serifd.nl, they tell me 95.211.9.46 and 95.211.9.41. And they respond authoritatively.

serifd.nl.              3600    IN      NS      ns2.nns365.com.
serifd.nl.              3600    IN      NS      ns1.nns365.com.
ns2.nns365.com.         3600    IN      NS      95.211.9.46.
ns1.nns365.com.         3600    IN      NS      95.211.9.41.

Great, they each tell me to ask the very same nameservers I just asked.

And, just for fun, they throw in this incomprehensible garbledygook:

95.211.9.41.            3600    IN      A       50.57.205.238
95.211.9.46.            3600    IN      A       50.57.205.238

I can't even imagine what that means.

If I ask them what IP to use directly, they say:

serifd.nl.              3600    IN      A       50.57.205.238

So if I did manage to get an answer from them, it'd be wrong anyway. Your DNS is a mess.

Answer 2

Some additional findings:

dig @ns1.vlasveldmedia.nl serifd.nl ns

;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;serifd.nl.         IN  NS

;; ANSWER SECTION:
ns2.nns365.com.     3600    IN  NS  95.211.9.46.
serifd.nl.      3600    IN  NS  ns1.nns365.com.
ns1.nns365.com.     3600    IN  NS  95.211.9.41.
serifd.nl.      3600    IN  NS  ns2.nns365.com.

;; ADDITIONAL SECTION:
ns2.nns365.com.     3600    IN  A   50.57.205.238
95.211.9.41.        3600    IN  A   50.57.205.238
ns1.nns365.com.     3600    IN  A   50.57.205.238
95.211.9.46.        3600    IN  A   50.57.205.238

We have no recursion but the server adds additional data and glue information in it's answer. He knows who ns1.nns365.com and ns2.nns365.com are (while the delegation is broken for them as David stated). That looks either like a compromised dns database on this server or a poisoned cache. You should examine this server for security problems especially of your powerdns installation.