Member Avatar for luiii

Hi,

I have the domain registered but when I try to access it I get redirected to SNIP

I have no idea why this happens but I presume I've been hijacked somehow?

How can I fix this?
I've already contacted my hosting provider.

Thanks

Edited by happygeek because: hijacker URL snipped
  • 3 Contributors
  • 12 Replies
  • 179 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by darkmobius

Dani AI

Generated

Brief summary: the symptoms described by (hand‑coded PHP/MySQL site, no client JS) together with and others seeing the same behaviour on the same provider point away from a pure client‑side redirect and toward either server/configuration level or DNS/hosting‑platform issues. 's suggestion to check files and the database is good — but when multiple accounts are affected you should treat the host platform as a likely vector.

Practical checks (do these before changing anything permanent):

# see where the redirect happens (Location header + full HTTP exchange)
curl -v http://yourdomain.example

# search the codebase for common obfuscation patterns
grep -RIn --exclude-dir=logs -E "base64_decode|gzinflate|eval\\(|str_rot13|preg_replace\\(" .

# quick DB search for injected URLs (adjust table/column names)
SELECT id, content_column FROM some_table WHERE content_column LIKE '%http://%';

Also inspect .htaccess, any auto‑prepend PHP files, global include files, and cronjobs. Check file modification times against backups.

If the host is implicated: ask for raw access and error logs (with timestamps), request a list of changed system files, and ask whether a server‑side proxy, caching layer, or control‑panel exploit could cause a transient redirect. Preserve copies of logs and file listings before you or they alter anything — that helps trace the root cause.

Short remediation and prevention checklist: rotate hosting/FTP/control‑panel/registrar passwords and enable 2FA where available; switch FTP to SFTP; keep server and PHP libraries patched; add simple file‑integrity monitoring (daily md5sum or Tripwire) and offsite backups; move to a different provider if the same provider shows repeated, unexplained incidents. If multiple customers were hit (as observed), insist the provider gives a concrete root cause and remediation plan.

Recommended Answers

All 12 Replies

Member Avatar for peter_budo

Your dns entries looks fine http://whois.domaintools.com/lewisharper.co.uk. Check your files for any changes, specially any unknown JavaScript that could provide them with injection and way to redirect. Most likely affected would be index.html/php or files directly associated with it

Member Avatar for luiii

Hi, the content of the files is unchanged. I have no JavaScript whatsoever in the Website.

Just PHP/HTML

I did google the domain I was being redirected to and it showed another website which had been affected overnight too

Member Avatar for peter_budo

What sort of application/blog you use on your site?

Member Avatar for luiii

What sort of application/blog you use on your site?

Hi,

It was just a website I created from scratch using PHP/HTML with a MySQL database, I made it for a University project.

It's working again now though, no more redirects. I have no idea who fixed it still.

Thanks

Member Avatar for peter_budo

Well I just checked and redirect is still there...

As for your site, there must be something on it that you either user insecure SQL queries or somebody was able to tamper with any other way. You should look on your database entries if there been any new or some changes and also check your files in any case if somebody got access to your server and was able to tamper with it

Member Avatar for luiii

Hi,

I just received a reply from my web hosts and they said the redirect is an issue on their server which they are working to resolve.

Thanks

Member Avatar for darkmobius

Was going to respond, I use Qiq as a host (assume same for you) and have the same issue. They seem to have fixed it during the day and now it's gone back to the same problem.

Member Avatar for peter_budo

You guys may consider move to different provider then as it seems that it was their system machines they been screwed and if they reported solved and now back in same redirect state, it mean only that their security is flaky and their stuff doesn't learn from previous mistakes.

Just my 2 pence

Member Avatar for darkmobius

Ironically I moved from another host because of issues. This is the first time in a couple of years anything has happened at all with them. If there's still a problem tomorrow, I think I will cancel and move. Any recommendations?

Member Avatar for peter_budo

You can always buy VPS and set it way you like it, so if there is something wrong only the person likely to be blamed will be you. As for provider I cannot advice since I'm into Java hosting unlike you guys on PHP

Member Avatar for luiii

Was going to respond, I use Qiq as a host (assume same for you) and have the same issue. They seem to have fixed it during the day and now it's gone back to the same problem.

Sorry I missed your post. Yes I am with QIQ and I think they solved this issue now.

£0.12 for 2 years was a good deal for my hosting needs :)

Member Avatar for darkmobius

Sorry I missed your post. Yes I am with QIQ and I think they solved this issue now.

£0.12 for 2 years was a good deal for my hosting needs :)

Yes they seemed to solve it around 7PM last night I think. If I have anything more critical I think I will use another host anyway. I guess you get what you pay for.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.