Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just discovered that our server other's website for example: should say "This Web Page no longer exists." but in 50% hits it shows an image from kind tenant website. This image is not stored on our server and apache access logs does not list hits when image is displayed.

Is our ip under ip attack or something? How to stop and prevent that?

Thanks, Marek

share|improve this question

closed as off topic by Luc, AJ Henderson, Terry Chia, Rory Alsop Apr 15 '13 at 21:27

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Is your website hosted on instapage? – xDragonZ Apr 15 '13 at 12:10
Yes, that page is hosted on Instapage. 50% of traffic which should go to our balancer does not hit Instapage web server. Unfortunately Amazon balancers does not allow to view any logs. – Marek Dajnowski Apr 15 '13 at 12:24
As per @Luc's answer, this is not a security issue. Closed as off topic. – Rory Alsop Apr 15 '13 at 21:28

No you're not under DNS attack. What even made you suspect that in the first place? What makes you think this is some security related attack in any case? It sounds like a bug on your site only, not of use to anyone else, and certainly not security related.

DNS lookups return only one IP for me, so all requests go to that IP but are handled differently from time to time. This makes it completely unrelated to any possible DNS issue. I am curious how you came up with the idea that it was a DNS attack.

The site was hosted on free hosting, all kinds of random events can occur there. Here it (for some reason) displays the (presumably) original file sometimes, and an error page at other times. I'd say their systems are not running synchronized or something, you should try again later. Or you just contact your host like you are supposed to when you have problems with your host.

For information's sake, it seems to be cookie-based. When I F5 or ctrl+F5 the page it shows me either the image or the webpage. It happens to be 50% of the time that I see the image, but it's not probability-related. It simply shows the webpage every other time.
When I open the page in incognito mode it will show me the image. Closing incognito mode and then opening it again, shows me the image again (this erases cookies or other set data). I haven't looked at the connection data, but that's what makes me think that it's cookie-related.

To resolve this, just ask the host. This is not related to security and thus I voted to close the question.

Edit: Saw your comment about your load balancer. Interesting combination, load balancing on free hosting. Perhaps include more details so that we can understand what might be going on, or what makes it a security question anyway?

share|improve this answer
Luc: When we switched down Instapage's apache, the 'not our' image still loaded, 'This Web Page no longer exists.' did not load certainly. – Marek Dajnowski Apr 15 '13 at 12:45
For a bit we even removed all instances from balancer and image was served. Contacted Amazon support. Thanks for attention. – Marek Dajnowski Apr 15 '13 at 12:52
When I created new balancer with ip and pointed domain there trying never gave me image – Marek Dajnowski Apr 15 '13 at 13:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.