0

I have the EXACT same problem that was addressed in a former thread on Stack Exchange here:

https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-website

enter image description here

As you can see from the image above from the site: command in Google, someone has created subdomains off of my domain. The results seem to be in Russian and, even worse, the subdomain part of their URLs are explicit content terms.

I have NEVER clicked on any of these results for fear of viruses etc.

My website is hosted at HostGator and trying to even explain this problem to their tech support has been very difficult.

I went into my cPanel and checked if there were subdomains there: No. I checked a couple other things: Nothing odd.

And from the link I posted above to another similar thread, the answer Chris Rutherfurd gave is probably my problem, as well but I don't understand the problem well enough to 1) fix it myself or 2) simplify it enough to explain to the Hostgator tech support person.

I still don't know if the problem is with HostGator or my registrar (Network Solutions).

Can anyone help?


In the comments below, Vladislav has pointed me in the right direction I think. I found a website that runs the dig command for you and got some output including an IP address in Provost Utah for a company called Unified Layer - I think this is BlueHost and that BlueHost and Hostgator are now owned by the same company.

  • 1
    I've done DNS lookups on several of the subdomains, and not found entries in the current (Apr 18 07:30 UTC) DNS tables; trying to visit the domains gets me errors consistent with this. I also tried sending an HTTP request to your server asking for one of those domains, and got a 404 error. (If you see two entries in your web server log relating to one of those, just before 7:30 UTC, that was just me). So I don't see anything live right now (though I might've missed something), but apparently there was something at some time, when google crawled those sites. – Gordon Davisson Apr 18 at 7:38
  • 1
    I'd see if you can register with Google's webmaster tools, and see if it can tell you anything about where/how it found those subdomains. – Gordon Davisson Apr 18 at 7:42
  • 1
    Why did you post this question here and not on Webmasters, if this is where you found the original question? – MechMK1 Jun 14 at 13:17
2

The problem is that someone was able to register the subdomains.

I used https://dnsdumpster.com/ and got the following data:

outdoorsthatsoftcore1.beginnergolfswingtips.com
31.210.173.89
hosting.eurohoster.org  
AS197793 LLC Gigabit
Russian Federation

From the map, it shows that the other DNS has A records.

You need to work with the support team of whoever runs your DNS (likely to be Hostgator) to get control back of your DNS and remove the A records of the malicious domains.

1

Try checking the contents of your actual domain zone, by using a command such as dig (Linux) or nslookup (windows). If the server was exploited, most likely the cPanel won't show anything.

How is your domain connected to your server, do you use the DNS service provided by your hosting provider or domain provider?

  • 1
    Pretty much show them the screenshots and tell them you haven't made these subdomains neither see them in cPanel and that they are spam. Hopefully that would be enough of an explanation. – Vladislav Korotnev Apr 18 at 2:21
  • so I found this website that runs the dig command for you: digwebinterface.com by inputting your domain, Type - I used 'A' for address record I guess, and Nameservers: Default - it actually shows the dig command it executed written out. The IP Address returned was: 50.87.145.23 in Provost Utah. – voodooman Apr 18 at 2:35
  • Thank you Gordon!!! I have Google Webmaster Tools and Analytics. There is nothing about these subdomains in either or. Perhaps someone hacked me awhile ago. I now have much better passwords etc on all my accounts but perhaps the vulnerability is on the HostGator side. Maybe now it's just a matter of waiting for G to deindex the Russian subdomains. – voodooman Apr 18 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.