Hi Geoff, First off, I make no claim to be a web hosting guru - so forgive me if I miss the point or "state the bleedin' obvious"
However, I do manage the website for Gilbert's potoroo Action Group (GPAG) which I have set-up to direct 2 different URLs to the same website. In our case, I set-up www.potoroo.org as our website and then we later decided to also capture the Australian www.potoroo.org.au domain and point it to the same site. This was easily done using the "parked domain" feature of our hosting package - basically I log into the primary domain using cPanel and go to "parked domains" under the domains section of cPanel, where it says: > Parked domains allow you to ³park² additional domain names to your existing > hosting account. This allows users to reach your website when they enter the > parked domain in their browsers. In our case, I have not set-up any redirection - I have just set the existing public html folder as the domain root for the parked domain which means that the site just works whichever URL you enter by and whichever page you enter by. The basic domains default to the index page but all pages continue to show the appropriate URL depending how you entered the site. Your situation is slightly different situation in that the two domains do not both point to the same top level in the site. Now, I don't know how this has all been set-up but it looks like they have set-up a subsection www.greenskills.org.au/ecojobs - with a redirection from the secondary (old) domain ecojobs.org.au to a specific page in this subsection http://www.greenskills.org.au/ecojobs/ecohome.html. The first thing I noticed about the rogue page was that below the flashy box, over the picture, it says: > Copyright, 100daily.host56.com All Rights Reserved And the URL 100daily.host56.com leads to a page that looks exactly like the page that www.ecojobs.org.au/index.html apparently redirects to. Now host56.com appears to be part of a a free web-hosting service provided by 000webhost.com as on www. host56.com, it says: > Welcome to the free web hosting provider www.000webhost.com > > We use subdomains under domain HOST56.COM to setup free web hosting accounts > for our clients. Each subdomain *.HOST56.COM is managed by different customer. > > To report abuse click here. So, assuming that 000webhost.com is a good web-hosting company, you COULD try reporting the 100daily.host56.com sub-domain as having hijacked traffic from www.ecojobs.org.au/index.html HOWEVER I am not sure that the problem here is that the URL www.ecojobs.org.au/index.html is actually being redirected. I tried using the Web Page Test from the test tools at WebSitePulse <http://www.websitepulse.com/help/tools.php> which shows the page as loading correctly and, interestingly shows the red-animated.gif file as loading with an address of http://www.ecojobs.org.au/images/red-animated.gif I must admit, I am punching way above my weight here in terms of understanding what is going on - but I wonder if the culprit has actually managed to infiltrate the "public_html" folder for the original ecojobs.org.au hosted site and put his stuff in there and that the redirect to www.greenskills.org.au/ecojobs has only been set-up to capture the main URL www.ecojobs.org.au but requests to individual files/pages are still going through to the old (now hijacked) hosted site. As you have noted, both domains greenskills.org.au and ecojobs.org.au have the same DNS lookup of 198.38.82.169 (as do 1,543 other sites) and use the same nameservers: ns2000.mochahost.com ns1000.mochahost.com So what I would be looking at doing first would be to log-in to the control panel for the ecojobs.org.au website and seeing what is there. In the past, I have found the cPanel log-in to be typically domain:2082 though, on my site, this now redirects to domain:2083. I note that: http://www.ecojobs.org.au:2082/ http://www.ecojobs.org.au:2083/ Both bring up a cPanel log-in panel - so entering the site administrator user name and password should let you into cPanel and let you look around at what is happening - I would first go to the "public_html" folder and see if there is an index.html file there that shouldn't be (as in one for the 100 days offer). Mochahost do have and extensive online knowledge base: <http://www.mochasupport.com/kayako/index.php?_m=knowledgebase&_a=view> including various tutorials: <http://www.mochasupport.com/kayako/index.php?_m=knowledgebase&_a=view&paren tcategoryid=74&pcid=0&nav=0> These may provide further guidance. HTH Cheers Neil -- Neil R. Houghton Albany, Western Australia Tel: +61 8 9841 6063 Email: [email protected] on 22/1/15 15:24, Kaye and Geoff at [email protected] wrote: > Hello Muggers > > I have an interesting problem which someone might recognise and be able to > explain. It is a version of a web page hack, but with specific symptoms. It > involves an environmental organisation called Greenskills - we do their web > page support for them. > > They own several domains, in particular greenskills.org.au and ecojobs.org.au. > Ecojobs.org.au is being phased out so if you point a browser at it a page is > displayed which immediately redirects to an "ecojobs" page on the main site. > Or at least this is what happens if you enter the URL www.ecojobs.org.au/. > With this format you rely on the default HTML file name, which in this case is > index.html, as is standard for most sites. > > However if you enter www.ecojobs.org.au/index.html, you get a flashy page > which wants you to sign up for what I suspect is a pyramid selling scheme. The > html source is for this flashy page, it has not done a redirect and the > ecojobs URL is the one displayed in the window at the top of the browser. > > The nameservers for ecojobs.org.au have not been corrupted - they point to the > correct place. > > A search of the net has, surprisingly, shown no pertinent information about > this scam. The source code has some links in the header which suggest that > someone in the Ivory Coast might be behind it. The source code does not appear > to have any actual nasties in it; ie. any code or links which look like they > might be trying to download a virus or something along those lines. > > Has anyone got any insights into this? In particular at what point in the > process of retrieving the web page does the "switch" occur? > > I have informed the hosting company which Greenskills use but so far have no > comment from them. > > Thanks > > Geoff > ----------------------- > Kaye and Geoff > [email protected] > -- The WA Macintosh User Group Mailing List -- Archives - <http://www.wamug.org.au/mailinglist/archives.shtml> Guidelines - <http://www.wamug.org.au/mailinglist/guidelines.shtml> Settings & Unsubscribe - <http://lists.wamug.org.au/listinfo/wamug.org.au-wamug>
