hi to all, i haven been here i a while, question and need help
i own a domain example.com and also a subdomain app.example.com they are hosted in digital ocean and managed with cyberpanel, the problem i have is that i google the domain name only in google and i just scrolled true the results and one particular domain called my attention because it has the same meta tag on result like the same wording that i have on the domain. so i clicked and it takes me to https://arabesto.pedir.online/login and is showing my server information with out using my domain name, i have no idea whats going on here, please some one give me an idea on how can i fix this problem
the design and login is but the domain is not mydomain is different but for some reason wen you go to arabesto.pedir.online it takes to my custom app
Is https://arabesto.pedir.online/login your website?
That means they have same template as you. That does not necessary mean there is any foul play.
https://arabesto.pedir.online/login this domain is not my website, but what you see is my app for some reason the fkn domain is pointing to the server where i have the app or somethin like that i do have a domain but is not https://arabesto.pedir.online/login
this is the first time it happens to me, when you click the link it takes you to my app, i think hacker are trying to fish or something like that to get user name and password. im still trying to figure out what is causing this. Do you have and idea of whats going on
- Did you purchase a template from someone?
- Do you know Eduges Cloud Platform?
1 we did not buy any template from no body
eduges is our platform, our domain is eduges.com.gt i just don’t understand why de other domain is linking to our app.
Then it seems your website was scraped because that link has your meta data.
Since this is not a CyberPanel related issue kindly take the legal steps to sort this since this is not a technical issue.
forgive me please, i’m not understanding the scraped part, and in this case what you think should be my step, because it looks like some how they are using my server to still user and password from users
thank you i will read on it, one more thing is that when i do a dnscheck on the domain that is not ours it shows my server ip. that’s what it confuses me more.
Your Ip address is not used by the domain in question pedir.online
thank you i will look into it. to see how this happen thank you for your help and information.
Hi @axiomteck,
Yes, you are right someone is using your server for loading your app over diffrent domain.
Because it’s showing your site SSL while opening that domain.
install the CSF and block that domain A record and try opening that domain.
Also check how they have pointed the site to your server.
No
This is just a phishing attempt by obtaining a legit ssl certificate and scraping their website. He should Another domain is pointing to my server - #8 by josephgodwinke and contact his provider asap.
Activating csf or any firewall and removing records will not help.The problem with SSL certificates issued to rogue parties occurs during man-in-the-middle attacks where the communication can be routed to another server in this case a rogue AWS server.
In that case the attacker can choose to intercept, read and change traffic to his website. Therefore thw attacker will impersonate the server or anything in between.
so we figure it out. is CALL SPOOFING we already fix it, and i forgot that this server we have runs on NGINX we already took care of it thank you for the ideas and help i will be posting the solution later on. you can try to visit the bad domain and is not longer working already been take care. now it has me wondering on how can i protect from the same problem using CYBERPANEL.
https://arabesto.pedir.online/ this is the domain that was affecting us. to all of you pay attention on your servers and domains. someting similar can be happening to you.
Sure I called it here Another domain is pointing to my server - #16 by josephgodwinke
It is website spoofing - a form of phishing when an attacker builds a website with content or link that closely resembles, or even copies, the URL of a legitimate website that a user knows and trusts.
Solution: Cease and Desist order, Report domain abuse, Report abuse of AWS resources
If this is resolved kindly share the steps you took to fix this