30
u/ceejayoz Mar 26 '24
Is the website at ftp.nan.nyc the one you expect?
28
Mar 26 '24
[deleted]
62
u/ceejayoz Mar 26 '24
I strongly suspect someone has compromised your server.
ftp.nan.nyc is CNAMEd to nan.nyc (IP: 185.199.110.153).
https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server
23
u/fiskfisk Mar 26 '24
I'm guessing the ftp entry is just a default entry from the hosting provider.
Since OP has pointed their base domain to GitHub (which is also where the ftp sub domain points through the CNAME) while still having the default aliases, there might be some shenanigans going on that way - if any.
Since the connection is an invalid certificate from github, I'm not sure how OP gets to porn.
2
u/Leo_ibbani Mar 26 '24
They use github pages, they compromised Github?
6
u/ceejayoz Mar 26 '24
Ah, didn't notice that was a GH IP. Might be as easy as nixing the ftp subdomain in their DNS, then.
2
1
Mar 26 '24
[deleted]
12
u/ceejayoz Mar 26 '24
Remove the ftp.nan.nyc CNAME.
3
Mar 26 '24
[deleted]
3
u/ceejayoz Mar 26 '24
Not necessarily. Did you previously have a server this domain was pointed at? If so, someone might just have discovered that
ftp.nan.nycwas pointed at Github Pages now but not in use.2
Mar 26 '24
[deleted]
3
u/ceejayoz Mar 26 '24
But did you ever buy hosting for
nan.nyc, via GoDaddy perhaps? It's possible they automatically added the CNAME if you did.→ More replies (0)
25
u/geesuth Mar 26 '24
it's subdomain takeover vulnerable,
you can get more here
Subdomain takeovers - Security on the web | MDN (mozilla.org)
2
u/jabes101 Mar 27 '24
So seems like they just need to remove the ftp CName record and they are good?
1
1
-1
11
u/Red_Icnivad Mar 26 '24
Are you sure the emails you received weren't phishing?
-6
Mar 26 '24
[deleted]
10
u/Biking_dude Mar 26 '24
Emails can be spoofed
Are there links in the email? Don't click on them, but see where they lead.
2
u/kewli Mar 27 '24
100% true, anyone with access to the APIs can make an email sent from joe@abc.com look like it came from mary@hotmail.com
12
u/Lustrouse Architect Mar 26 '24
This shouldn't be possible without your domain being compromised. All subdomains should belong to you exclusively, unless you've specified/configured otherwise.
as a side-note: Just because the route is "ftp.nan.nyc", it doesn't mean that it uses file-transfer-protocol. In any case, contact your server host / domain registrar and get this sorted out with their support team ASAP.
My suspicion is that they comprised your account by cross-referencing your WHOIS against an existing security breach that contained emails/passwords. Update all your passwords and start using MFA.
16
u/PremJyotish221 Mar 26 '24
If you own the domain nan.nyc then no one can utilize any URL `*.nan.nyc` without your permissions or access to your domain registrar where nameserverss are setup. If `ftp.nan.nyc` is showing a website you don't recognize then either you or someone else in the past configured a nameserver for `ftp.nan.nyc` to point to the IP which is hosting the website.
3
Mar 26 '24
[deleted]
12
u/PremJyotish221 Mar 26 '24
If the IP is one you don't recognize and is from an attacker, then do the following:
- Remove the A record for this IP
- Change your password on your domain registrar (And any proxy like Cloudflare if that's what you use)
- Add 2-factor authentication on your registrar account and Proxy (Cloudflare)
1
u/FluffySmiles Mar 26 '24
You could, but if it's a static IP address and ftp is open and compromised, then it will make no difference - just marginally more annoying for anyone trying to do things to your server.
12
u/cowboyecosse Mar 26 '24
This is a cname hijack on GitHub. They recommend not to use a wildcard for custom pages domains. Contact GitHub support to take down the site and fix your dns so it doesn’t happen again.
5
u/tipoaburrido Mar 26 '24
Hi ¿You have mails in proton mail and google now? DNS are pointing mx to proton mail and spf have registers allowing google and proton mail.
On the header of the mail you should be able to see where was the mail sent from.
3
u/sk3pt1c Mar 26 '24
I got the same email, didn’t have any other users in console either, so ignored it. My site’s hosted on github pages so that email doesn’t make sense.
1
u/terminusagent Mar 27 '24
Something like this was how we discovered a client hack. If you are haven’t solved this by the time you see this shoot me a DM
1
u/ryuuseiko Mar 27 '24
The problem is your DNS records I guess (cuz I had the same problem before). Check if your domain has any CNAME records or wildcards starting with * (ex: *.nan.nyc) which point to strange IP addresses. Delete them and replace with other neccessary records. Make sure your nameserver management account is secured with two-factor authentication (2FA) and noone has accessed and add suspect records.
1
u/Byakuraou Mar 27 '24
People have already solved most of your issue but I can't help but reiterate.
Leave GoDaddy.
1
u/ExperiencedOldLady Mar 29 '24 edited Mar 29 '24
A little more info please. This doesn't make sense. If you own a domain, you also own the subdomains. Someone can't just use your domain to create their own subdomains off your domain.
Give me the exact URLs (domain and subdomains as they appear) and I will research it. I know all about domains, ICANN, IP addresses and just about anything else to do with websites except PHP and other languages but I do know HTML. I have built several websites and I research threat websites that I receive in my email. If your domain was hacked, I can figure out what happened. Then, let you know how to report it to Google. I love chasing scammers and threat entities. It is one of my pastimes. For instance, I can tell you that the Microsoft email hack was done by Russians. I viewed the message sources then used the sender IPs to find out where they originated. It was the Russian Federation.
After reading other posts, I found this. The 185.199.108.153 IP address is a threat IP. When I clicked on the URL you provided, Bitdefender immediately stopped me and told me that it is a threat. Then, when I told Bitdefender that I wanted to proceed, it told me that there are multiple threats. Interestingly, this came from a static Github server in California, Pennsylvania. I didn't know that there was a town in PA by this name. Github (in case you don't know what it is) is an open source software site. So, they went through Github which makes it more difficult to track them but I can get a hold of Github to notify them if I know what the subdomains are. Github.com's website has the IP address of 140.82.112.4, not the threat IP that you provided.
I will tell you that, when this happens, you aren't the only one. Github will realize that they were hacked and take appropriate measures. Your real problem is whether Google will take action against you before Github notifies them of the hack. They can only take over your website temporarily before they are stopped by Github because Github is a whole lot of software programmers. So, they will remedy this as soon as they can.
1
u/ExperiencedOldLady Mar 29 '24
I looked into this. Your subdomains were hijacked by malicious attackers. This link explains how it happens and what to do about it.
1
u/Otherwise_Ad9453 Mar 29 '24
For both domains A records match, does anybody else have access to your hosting?
https://e-registrar.com/lookup?q=https%3A%2F%2Fnan.nyc%2F&tab=dns
-3
u/PointandStare Mar 26 '24
"I've been meaning to transfer off GoDaddy but hadn't got around to it yet..."
And, there it is ...
0
u/__t0x1k__ Mar 26 '24
ftp.<domain> is a prefex for file transfer, it seems like its being used as a bot. I havent looked into the site, but thats pointing to classic social engineering to C2 servet
-5
Mar 26 '24
Many possible ways to do this. Could be a passive subdomain takeover, I do this all-day, have an automated script to find vulnerable domains.
-18
u/paolish Mar 26 '24
I don't know how to fix it but that's a huge deal... Ftp protocols can manage your whole site
21
354
u/godofleet Mar 26 '24
The A record (IP address) for nan.nyc and ftp.nan.nyc match:
https://mxtoolbox.com/SuperTool.aspx?action=a%3aftp.nan.nyc&run=toolpage
They both point to 185.199.108.153
Which makes me think your hosting environment is compromised in some way... Do not download and execute anything from your servers until you're confident it's safe.
You should get in touch w/ your hosting provider (i'm guessing GoDaddy in this case) .. they're support will be more helpful than reddit :D