DNS Hijacking, Wrong Site Loading

Here we explain steps to take if a domain registered elsewhere pointed to our nameservers displays a hacked site. This situation involves no active hosting account at InMotion Hosting for the impacted domain. In this case, the site's A record changed to point to a third-party server running malware.

Essentially, the domain is registered with another registrar and pointed to InMotion Hosting nameservers, but the domain owner does not have hosting with us.

This article also covers several other situations where the wrong site may be loading and supplies steps to correct this.

Related Article

Check DNS for a Domain

Check Current DNS

1. Using a terminal, use the dig command on the domain, which will show the A record value 
2. Use the following command to find the nameservers for the domain

   dig domain.com ns

   REPLACE: domain.com with your domain.
3. If using Cloudflare nameservers or another proxy service, double-check the A record on the nameserver

Site Hosted Here

1. If the site is hosted here, double-check the correct IP is being used by comparing the A record from earlier with the IP listed in your cPanel
2. If the domain is using our nameservers but is not pointed to the correct server, contact Technical Support for assistance
3. If the domain is not using our nameservers and is not pointed to the correct server, update the A record on the nameservers
   IMPORTANT: Propagation of DNS changes can take 4 to 24 hours to fully complete. 
4. If the domain is pointed to the correct IP
   1. If you're on an NGINX server, try clearing your cache
   2. If problem continues, contact Technical Support

Site Hosted Elsewhere

1. If using our nameservers
   1. If you have hosting, update the A record in the cPanel Zone Editor
      IMPORTANT: Propagation of DNS changes can take 4 to 24 hours to fully complete. 
      
   2. If you no longer have hosting, update the nameservers to a third-party nameserver service, such as Cloudflare
      NOTE: DNS Management, such as the ability to update the A record on our nameservers, is only available with a hosting plan.  If you had a hosting plan previously and have since canceled it, you will need to modify the nameservers in order to update the A record.
2. If not using our nameservers, update the A record on your nameservers

Domain Registered Here, No Hosting

1. If the domain is registered with us, but you do not have hosting yet, update the nameservers to use our parked nameservers, ns1.imh-parking.com and ns2.imh-parking.com