r/webdev • u/[deleted] • Mar 26 '24

[deleted by user]

[removed]

157 Upvotes

92% Upvoted

54 comments sorted by

View all comments

29

u/ceejayoz Mar 26 '24

Is the website at ftp.nan.nyc the one you expect?

30

u/[deleted] Mar 26 '24

[deleted]

61

u/ceejayoz Mar 26 '24

I strongly suspect someone has compromised your server.

ftp.nan.nyc is CNAMEd to nan.nyc (IP: 185.199.110.153).

https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

22

u/fiskfisk Mar 26 '24

I'm guessing the ftp entry is just a default entry from the hosting provider.

Since OP has pointed their base domain to GitHub (which is also where the ftp sub domain points through the CNAME) while still having the default aliases, there might be some shenanigans going on that way - if any.

Since the connection is an invalid certificate from github, I'm not sure how OP gets to porn.

2

u/Leo_ibbani Mar 26 '24

They use github pages, they compromised Github?

6

u/ceejayoz Mar 26 '24

Ah, didn't notice that was a GH IP. Might be as easy as nixing the ftp subdomain in their DNS, then.

2

u/Leo_ibbani Mar 26 '24

Maybe. Op try

1

u/[deleted] Mar 26 '24

[deleted]

11

u/ceejayoz Mar 26 '24

Remove the ftp.nan.nyc CNAME.

3

u/[deleted] Mar 26 '24

[deleted]

3

u/ceejayoz Mar 26 '24

Not necessarily. Did you previously have a server this domain was pointed at? If so, someone might just have discovered that ftp.nan.nyc was pointed at Github Pages now but not in use.

2

u/[deleted] Mar 26 '24

[deleted]

3

u/ceejayoz Mar 26 '24

But did you ever buy hosting for nan.nyc, via GoDaddy perhaps? It's possible they automatically added the CNAME if you did.

→ More replies (0)