I host my website by my own using droplet/VPS service and node.js server. My wesbite uses SSL Cert/HTTPS from LetsEncrypt, VPS service from DigitalOcean, domain registered from local vendor (RumahWeb) managed by CloudFlare.
My VPS server is secured and clear, only I have the key (private key file) to access it. I enforce firewall with
ufw, use correct permissions to files, sanitize and encrypt everything from the user/client, and secure the database. The website works with no problem for years.
But, Several days ago, I notice there's an ad for a online gambling site suddenly popped up. here's what I know so far:
- It doesn't affect all ISP and cellular operators in my country. Only INDOSAT and TRI.
- On INDOSAT, the SSL works, the browser detects the injected script and gives a warning to user that the connection is not private. On TRI the website including the ad is displayed.
- It attacks by domain name. If I use the server IP to access it directly, it works, no ads whatsoever. Other domains and website from the same server are also not affected only this one particular domain
WHAT I TRIED SO FAR
Restart the server
Checking for the compromised files, Nothing's found. To prove it, I make a single blank html file and host it on a new node.js process. Even with the blank HTML page, the ad keeps showing up. It's injecting itself
Turn off the cloudflare and using the default (RumahWeb) nameservers. Not working
My domain provider can't help, the local ISP (INDOSAT and TRI) are too big to care. The only solutions I can think of is to provide alternate domain for my customers who're affected.
Or is it possible to remove the offending foreign script after website was loaded ?
This is beyond me. So I asked for help here... maybe some people will kindly offer me options or know-how to solve my situation.