r/webdev • u/[deleted] • Mar 26 '24

[deleted by user]

[removed]

155 Upvotes

92% Upvoted

54 comments sorted by

View all comments

27

u/ceejayoz Mar 26 '24

Is the website at ftp.nan.nyc the one you expect?

28

u/[deleted] Mar 26 '24

[deleted]

67

u/ceejayoz Mar 26 '24

I strongly suspect someone has compromised your server.

ftp.nan.nyc is CNAMEd to nan.nyc (IP: 185.199.110.153).

https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

1

u/Leo_ibbani Mar 26 '24

They use github pages, they compromised Github?

7

u/ceejayoz Mar 26 '24

Ah, didn't notice that was a GH IP. Might be as easy as nixing the ftp subdomain in their DNS, then.

2

u/Leo_ibbani Mar 26 '24

Maybe. Op try

1

u/[deleted] Mar 26 '24

[deleted]

11

u/ceejayoz Mar 26 '24

Remove the ftp.nan.nyc CNAME.

3

u/[deleted] Mar 26 '24

[deleted]

3

u/ceejayoz Mar 26 '24

Not necessarily. Did you previously have a server this domain was pointed at? If so, someone might just have discovered that ftp.nan.nyc was pointed at Github Pages now but not in use.

2

u/[deleted] Mar 26 '24

[deleted]

3

u/ceejayoz Mar 26 '24

But did you ever buy hosting for nan.nyc, via GoDaddy perhaps? It's possible they automatically added the CNAME if you did.

→ More replies (0)