Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them.

Sometimes it shows my actual website, but a couple of minutes after requesting it, when I revisit my site it shows a parking page (from

Me and my host have checked my nameservers, and DNS settings, and have made sure it's all set correctly. I have also checked my .htaccess files for as far as my sites have it, and I checked my php pages, but I can't seem to find anything wrong with them. I have also checked on different networks (locations) to make sure it's not my home network's fault.

Maybe someone could check it out for me to see what the problem is, or maybe has had this problem before.

Two of the websites are: and The ip-address they're (supposed to be) running on is

share|improve this question
What webserver are you running? – Lucas Kauffman Apr 8 '12 at 5:04

2 Answers 2

DNS is horribly broken. You say you checked nameservers and DNS settings -- I'd love to hear the description of what you found, because I'd call it an atrocious mess. has nameservers and When querying those nameservers, I'm redirected to and Nevermind that such a redirect is already broken.

So, to find or's IP address so I can ask them about, I have to check the namservers of But guess what, they're and, the very machines I was trying to find in the first place. Boom.

Let's look at Well, the nameservers are and But guess what? They direct me to and And it's the same nightmare all over again.

Oh, and here's the really fun part. When I ask or ( and what nameservers to use to resolve, they tell me and And they respond authoritatively.              3600    IN      NS              3600    IN      NS         3600    IN      NS         3600    IN      NS

Great, they each tell me to ask the very same nameservers I just asked.

And, just for fun, they throw in this incomprehensible garbledygook:            3600    IN      A            3600    IN      A

I can't even imagine what that means.

If I ask them what IP to use directly, they say:              3600    IN      A

So if I did manage to get an answer from them, it'd be wrong anyway. Your DNS is a mess.

share|improve this answer
Wow, that clears things up. Thanks alot for checking. By checking the DNS I made sure the settings were correct (, etc) at my domain registrar. But I guess there's something misconfigured at my hosting which redirects them to old custom nameservers (which apparantly redirect to another nameserver). Now to find out where to fix this. Thanks alot! – Jesse Vlasveld Apr 7 '12 at 12:44
That doesn't help, since and just direct me to and The nameservers are wrong to direct me there, and the nameservers are wrong for authoritatively answering for a domain they are no longer associated with. If you fix the nameservers, 95% of the problem will go away. – David Schwartz Apr 7 '12 at 13:02

Some additional findings:

dig ns

;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;         IN  NS

;; ANSWER SECTION:     3600    IN  NS      3600    IN  NS     3600    IN  NS      3600    IN  NS

;; ADDITIONAL SECTION:     3600    IN  A        3600    IN  A     3600    IN  A        3600    IN  A

We have no recursion but the server adds additional data and glue information in it's answer. He knows who and are (while the delegation is broken for them as David stated). That looks either like a compromised dns database on this server or a poisoned cache. You should examine this server for security problems especially of your powerdns installation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.