8

I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line :

192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" 200 4043 "http://buttons-for-website.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/genericons.css HTTP/1.1" 200 14062 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/style.css HTTP/1.1" 200 894 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/header-style.css HTTP/1.1" 200 1208 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/js/mobile.js HTTP/1.1" 200 774 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:40 -0400] "GET /ressources/frameworks/font-awesome/css/font-awesome.min.css HTTP/1.1" 200 5782 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:44 -0400] "GET /ressources/img/nav.svg HTTP/1.1" 200 966 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"

It wasn't http://example.com/, I changed it for privacy purpose. I was intrigued, and decided to go on that site. I was surprised to see that it was the exact copy of mine. With my own personal files (CV, etc). So I decided to check the IP address of that website :

; <<>> DiG 9.8.3-P1 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10369
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.com.       IN  A

;; ANSWER SECTION:
example.com.    14400   IN  A   IP_OF_MY_WEBSERVER

;; Query time: 60 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Tue Aug  4 16:52:53 2015
;; MSG SIZE  rcvd: 49

I was surprised to see it was the IP of my own VPS. Indeed, it seems that someone rented the example.com domain name and linked it to my website.

- Why would anyone do that ?
- Is there any security issue I should be worried about ?

Improve this question
4
  • 10
    Now might be a good time to make sure all the files your web server is serving are files you put there.
    – gowenfawr
    Aug 4, 2015 at 15:08
  • 1
    Does the bye-powerpoint.com change with your site changes?
    – RoraΖ
    Aug 4, 2015 at 15:11
  • 3
    According to your resume.pdf, you've learned about "Exploitation of DNS vulnerabilities". I would have expected that you'd already know how to find out who is responsible for any specific DNS record and how they might be contacted ...
    – Hagen von Eitzen
    Aug 4, 2015 at 18:41
  • Speaking of security issues (though unrelated to the DNS mishap): You seem to be using version 2.2.22 of Apache. Check for security issues
    – Hagen von Eitzen
    Aug 4, 2015 at 19:12

3 Answers 3

Reset to default
5

While it could be part of some attack, my suspicion is that it was a mistake. Perhaps the registrant had that IP previously. You'll have to check your VPS company's/plan's details. You may have a fixed IP or a variable one (not likely). Even with a fixed IP, the VPS provider likely gave that IP to a previous VPS user.

However it happened, they need to get a new IP.

There is the possibility that the DNS entry for bye-powerpoint.com still points to your IP address. If this is the case, it likely means that the site is dead (otherwise they would have noticed that their site has become inaccessible).

Actions you can take:

  1. Contact your VPS provider and see if they can help you. They've given you an IP address that is prone to spam. They should fix it or give you another one.
  2. Lookup the domain name in an online whois site (eg: this one) and see if you can get contact information about the registrant. You usually can get an email (though sometimes it is just a dead drop). Let them know the problem and see if they will/can correct it.
  3. Contact the registrar that registered bye-powerpoint.com and let them know what is going on. They should fix the DNS mapping once they know it's wrong.
  4. You can configure your web server to have a vhost that will reject requests, perhaps with a 403 status code.

Hope this helps.

EDIT: I updated the answer based on comments. Thanks everyone for the help.

Improve this answer
4
  • 1
    While doing all of this, you can setup a vhost for the domain and send back a 403.
    – r00t
    Aug 4, 2015 at 16:33
  • 1
    "that certificate is dead to the registrant. They just need to pay the few bucks and get a new one" what? why shouldn't they just be able to change the DNS record to point to their actually address?!?
    – o0'.
    Aug 4, 2015 at 17:25
  • 1
    According to whois, the registrar is even in the same city as the OP,so a local phone call might be enough
    – Hagen von Eitzen
    Aug 4, 2015 at 19:07
  • "that certificate is dead to the registrant" - What certificate? I don't see any indication of any use of SSL / HTTPS, so I don't see where certificates enter into it. Are you confusing a certificate with a domain registration or a DNS entry?
    – D.W.
    Aug 4, 2015 at 20:41
4

My guess for this would be that the person has made a mistake and did not intend to set the web server to be the IP address of your site. It could be that they were intending to park the domain and got the IP address wrong

In terms of security risks, the main one might be that the content of your site appears under their domain name, but that doesn't sound too likely as a risk generically (which is all that can be said without seeing the content of your site).

If you want to block the traffic, you could just set-up a Vhost in Apache so that if anyone arrives at your server with that domain name they're redirected or you could show a page that says "hey this isn't your server" or something similar.

Improve this answer
3

One possibility would be to try the Internet Archive or similar to check what the site looked like in the past. You may then be able to pin point when there was the change, and whether it was legitimate in the past.

You'll probably also want to look at the date the domain was first registered. Was it some years ago, or more recently? If a longer time ago, it could be a change of VPS, with the domain having not been updated. If recent could be a typo, or malicious.

I'd recommend setting up your server to only serve pages from known domains, to prevent this issue.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .