Parked/unused domains land on Hungarian html pages/redirecting to malicious site

Website, Application, Performance Security Center
1

I just discovered all 39 of my parked/unused domains land on Hungarian html pages that redirect to malicious gaming site. Where should I start to fix this?

2

You should start by posting all of them as code in a list, like:

  1. domain1.com
  2. domain2.com
  3. domain3.com
    […]

Then people here can analyse them and help you.

1 Like
3

Here’s one

cargo-spectrum.biz

They are all like that.

4

My web host already had me add an A record to point one of my unused domains i.e. newdomaingss123 dot com to my web server IP address. Then on the web server, we added a redirect to my primary domain. But that didn’t do anything.

We also created a temporary URL using SkipDNS and that didn’t work either.

5

Your website got compromised/hacked and does not have anything to do with Cloudflare.

In your DOM/HTML there is this sectionby some filthy JS snippet. This is completely unrelated from Cloudflare and technically could be implemented anywhere. If multiple sites are affected and they all are on the same server, I would assume your server got infiltrated - specially since the faulty JS is actually getting served from your domain.

The filthy JS snippet looks something like this:

<script type="text/javascript">
[... JS ...]
(document, "script", "https://cargo-spectrum.biz/adapter.js");
[... JS ...]
</script>

You need to find and eliminate it. Could be on your server as a file somewhere, or actually already in your DB.

I would recommend approaching the problem like this:

  1. log into your server via SSH and search recursively for *adapter.js*
  2. log into your DB and search it for adapter.js
  3. delete all the JS of your findings, if related to this bad JS snippet
6

To have a quck-validation of the fact, that the /adapter.js is the culprit you can simply open your Dev-Console in your browser and block the file https://cargo-spectrum.biz/adapter.js (or even better something like *adapter.js. Then hardreload the page - now your page should work. It will just work for you and no one else, but that gives you the possibility to debug it

8

And thank you by the way. I totally appreciate your time. My last question is only me seeing if it’s a possibility.

9

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.