4

Recently, my website was subject to a DNS attack of sorts. I have my domain name (which I won't say here but should be pretty easy to find if you're interested) registered with Hostgator and set up with NameCheap's FreeDNS service. Recently I saw that my domain was serving an error page in Chinese rather than my pages (usually hosted on Github Pages), so I looked into the DNS configuration and found an A record to a malicious IP:

;; ANSWER SECTION:
[Website name redacted].com.    1285    IN  A   198.56.143.241

Doing some sleuthing on this IP reveals that it's maintained by Enzu, Inc, which seems to serve a lot of spam, and reverse DNS lookup points to Asia.Optimization.to.cn.: http://mxtoolbox.com/SuperTool.aspx?action=ptr%3a198.56.143.241&run=toolpage

There seems to be really no impact from this except that my site was down for a little while, which I'm not very fussed about.

I deleted this record and reset my passwords (and enabled 2FA) on both Hostgator and NameCheap accounts. My question is: is there anything I need to do other than that? It's not really clear to me if my NameCheap account was cracked or if this was related to something else - that account has a pretty strong password (long, dictionary-attack resistant, etc) and this doesn't seem directed specifically at me. I'd like to be sure I've taken appropriate action so that this won't happen again (and so that I'm not still vulnerable to the same attacker).

0

If the A record was visible in your NameCheap web interface, then your account will have been compromised. Probably via a weak password.

However, it is possible that NameCheap's servers are also compromised, you really have no way of knowing unless you put in a new, very strong password and/or 2FA as you have and then you get the same problem again. Any decent hacker though would detect that you'd undone the hack and would avoid you.

The other possibility is that your PC is compromised so you should double check that.

I also recommend that you set up an automated monitor using one of the many free services. It should check the content of your page and if it changes, you should get a notification.

  • Awesome, thanks for the answer. Would you be able to refer me to any of the free monitoring services which you mentioned? – Noah Gilmore Oct 4 '16 at 15:31
  • No problem. monitor.us is one I use. Also versionista.com, wachete.com and many others. – Julian Knight Oct 4 '16 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.