Serves wrong page just in some locations

On the 12th of July, I got a message from Google Search Console that all of a sudden the text on the homepage is too small. But nobody made a change in days.

So I just opened the page and saw a random Japanese page without an SSL cert.

Like this:
https:// webcache . googleusercontent . com/search?q=cache:r_G0xF3MmXkJ:https://indies.at/+&cd=1&hl=de&ct=clnk&gl=at

I played around with my local dns settings. I remove my local set Google DNS (8.8.8.8, 8.8.4.4) and Cloudflare DNS (1.1.1.1). So just my ISPs DNS was in place.
Now the page worked like expected. So I thought this was a problem with my local dns cache or something.

On the 17th of July, the domain got renewed.

Yesterday my client called me and pointed at the Google Search result that said the site got hacked. Now Also I cannot replicate the issue with that page.

I can rule out that it is a problem with the webserver or the registrar.

Could imagine that it is a problem with page rule caching or DNS caching.

Domain:
indies.at

Search Console says that this page is the root of the error:
https://indies.at/index.php/ze256/jah9482307/r08os22507.html

Google Search Result:
https:// www . google . com/search?q=VTM%C3%96&oq=VTM%C3%96

This is a malware present at the origin server and has nothing to do with DNS. For as long as the malware uses your domain to generate their pages, they will be proxied by Cloudflare. You may at times visit your site and think it is not infected, but that only shows how smart malware has become. I just visited your site with a direct request and saw your actual home page. Then I did a site:example.com search and clicked on the home page result, and the visit was immediately hijacked by a Japanese-language site. They only redirect if you come from Google, as they know direct visitors tend to be the owner and friends. It’s a trick to avoid detection.

You should follow Google instructions to try and remove the malware, ore else hire a reputable website security firm to clean it for you.

This topic was automatically closed after 30 days. New replies are no longer allowed.