One of my friend has an eLearning website based on Claroline. Two days ago, only Switzerland users started to get redirect "randomly" on another IP address when accessing the website domain.
If I force the DNS server to 188.8.131.52 or 184.108.40.206 on the students' PC, the domain is resolved correctly. But if I stay with the local Swiss DNS Server, it resolves to a bad (blacklisted) IP address.
The strange part is: It's not only this one customer and his own computer. Every student based in Switzerland is affected as well. But not French ones.
The second strange part is: Some page responds from this false IP address with the correct content. Like the eLearning was duplicated on another server OR cached somewhere.
The server is an old Ubuntu 10.04.4 LTS, and it is probably not correctly protected / configured. I have full access on this server, but I didn't manage it, so I'm not sure what to look for or even what to do.
Here is what I looked at/ tried so far:
- Checked all Apache 2 vhost conf.
- Checked iptables (empty) and
- Asked Swisscom (main Swiss telecom) if they blacklisted the domain or something: Nope Checked claroline code base: it look safe, but it's huge. I can't check all files.
Here is a nslookup on one of the student Windows computers:
C:\WINDOWS\system32>nslookup Serveur par défaut : UnKnown Address: fe80::8e59:c3ff:fecf:8d9b > elearning.redacted-domain.ch Serveur : UnKnown Address: fe80::8e59:c3ff:fecf:8d9b Réponse ne faisant pas autorité : Nom : elearning.redacted-domain.ch Address: 220.127.116.11
And of course, 18.104.22.168 is not the correct IP address of the server.
I'm not a system administrator. I'm just helping a friend, so I'm not sure on what to look next.