Spammy 301 redirections + .php spam

Epicster · Jul 7, 2022

So, yesterday I brought a new domain, completely fresh, never registered before but today I am seeing lots of spammy 301 redirects being done on it.

With these spammy 301s, I am seeing lots of being redirected to login and brute-force attempts.

Like, spamdomain.com/wp-login.php > mydomain.com/wp-login.php

I am also seeing lots of other PHP brute force attempts which go to 404 pages. Some of them are coming from bing.com and yandex.com (Not fake ones but actual search engines)

Does anyone know how it's possible as the domain was registered yesterday and within hours I am receiving this spam or ways to get rid of them?

PotatoWatts · Jul 7, 2022

Most likely its bots that search for domains with certain keywords, randomly, and look for vulnerable usual logins so they can enter the website before its even ready and when it still has a weak password

bartosimpsonio · Jul 7, 2022

Did you check its previous history? Shouldn't be the target of this kind of spam if brand new.

ricardo.rosa · Jul 8, 2022

Setup a nice firewall on your domain like cloudflare or etc, they block must of BOT requests spam.
Its more secure for your host and for your domain content

cloudll · Jul 8, 2022

bartosimpsonio said:
Did you check its previous history? Shouldn't be the target of this kind of spam if brand new.

ofcourse he will not check, just put in ahref if spammy then you see a tons of links

thesuperhero · Jul 8, 2022

This is normal my friend, as soon as you are online you'll be found by some bot at some point. Just make sure your website is secure.

MGaLL · Jul 8, 2022

edit your login url to random one?

maybe if domain is indeed new then someone has access to your domain register and can see all new domains so attacking everything

Epicster · Jul 8, 2022

bartosimpsonio said:
Did you check its previous history? Shouldn't be the target of this kind of spam if brand new.

Yes, I checked everything, it's a brand new domain, registered never before.

ricardo.rosa said:
Setup a nice firewall on your domain like cloudflare or etc, they block must of BOT requests spam.
Its more secure for your host and for your domain content

I can block it obviously but I wanted to know why it is happening and how they are able to get the info.

cloudll said:
ofcourse he will not check, just put in ahref if spammy then you see a tons of links

stop jumping to conclusions

thesuperhero said:
This is normal my friend, as soon as you are online you'll be found by some bot at some point. Just make sure your website is secure.

Lol got found a few minutes after I registered the domain?

MGaLL said:
edit your login url to random one?

maybe if domain is indeed new then someone has access to your domain register and can see all new domains so attacking everything

This time I went with a new domain registrar and with a completely new registered account.

itz_styx · Jul 8, 2022

there are public lists of newly registered domains, so even if its not indexed in google yet, people can find it.
another thing is that IP ranges are being scanned for vulnerabilities, that is another way your site could have been found.

Epicster · Jul 8, 2022

itz_styx said:
there are public lists of newly registered domains, so even if its not indexed in google yet, people can find it.
another thing is that IP ranges are being scanned for vulnerabilities, that is another way your site could have been found.

That's very strange as I am seeing over 1.5k pings to /xmlrpc.php and over 100 wp-login.php attempts

TomTheCat · Jul 8, 2022

Epicster said:
Does anyone know how it's possible as the domain was registered yesterday and within hours I am receiving this spam or ways to get rid of them?

They have access to zone files, and crawl the new domains. The same does Google, Ahrefs, nothing new.

Epicster · Jul 8, 2022

TomTheCat said:
They have access to zone files, and crawl the new domains. The same does Google, Ahrefs, nothing new.

I do believe it has something to do with Cloudflare, by the way, do you know why Bing and Yandex crawl non-existent 404 PHP pages?

TomTheCat · Jul 8, 2022

Epicster said:
I do believe it has something to do with Cloudflare, by the way, do you know why Bing and Yandex crawl non-existent 404 PHP pages?

It was an expired domain then, or misspelled backlinks. There are people that link to non-existent domains by mistake.

Epicster · Jul 8, 2022

TomTheCat said:
It was an expired domain then, or misspelled backlinks. There are people that link to non-existent domains by mistake.

Nope, I did make sure nothing that happens, It is a completely brand new domain, registered the first time with no history whatsoever.

TomTheCat · Jul 8, 2022

Epicster said:
Nope, I did make sure nothing that happens, It is a completely brand new domain, registered the first time with no history whatsoever.

Setup a catch-all mail on that domain and check in a few days if any emails are coming in. If they come, the domain isn't brand new. And, FYI there are a lot of domains that aren't on any public datasets or tools that are registered or were registered in the past. If is a com/net/org/info, have you checked it on https://research.domaintools.com/research/whois-history/ ?

LuckyGamble · Jul 8, 2022

Epicster said:
So, yesterday I brought a new domain, completely fresh, never registered before but today I am seeing lots of spammy 301 redirects being done on it.

With these spammy 301s, I am seeing lots of being redirected to login and brute-force attempts.

Like, spamdomain.com/wp-login.php > mydomain.com/wp-login.php

I am also seeing lots of other PHP brute force attempts which go to 404 pages. Some of them are coming from bing.com and yandex.com (Not fake ones but actual search engines)

Does anyone know how it's possible as the domain was registered yesterday and within hours I am receiving this spam or ways to get rid of them?

your server was probably hacked if those .php pages have content and aren't 404 errors

Epicster · Jul 8, 2022

TomTheCat said:
Setup a catch-all mail on that domain and check in a few days if any emails are coming in. If they come, the domain isn't brand new. And, FYI there are a lot of domains that aren't on any public datasets or tools that are registered or were registered in the past. If is a com/net/org/info, have you checked it on https://research.domaintools.com/research/whois-history/ ?

I am really not that noob, I can assure you, I checked everything from buying it, it is a very unique domain with no history whatsoever.

I checked ahrefs, semrush, archive.org, similarweb, multiple domain registrars, whois and everything.

LuckyGamble said:
your server was probably hacked if those .php pages have content and aren't 404 errors

LOL, it's not. I registered the domain 48 hours back with another registrar, the domain has no history and is registered the first time.

Regarding the server, It was first installed and all of a sudden when I put that into Cloudflare, I saw tons of wp-login and PHP spam. I am also seeing 301 redirects from spam domains like 343794.com etc

IDK how its happening.

TomTheCat · Jul 8, 2022

Epicster said:
I checked ahrefs, semrush, archive.org, similarweb, multiple domain registrars, whois and everything.

Ahrefs has only 215 million domains. I have a database with over 1 billion. If you think is related to Cloudflare, just buy another random domain ifsd7c6t337637c32 and replicate what you did and see if still happens.

Epicster · Jul 8, 2022

TomTheCat said:
Ahrefs has only 215 million domains. I have a database with over 1 billion. If you think is related to Cloudflare, just buy another random domain ifsd7c6t337637c32 and replicate what you did and see if still happens.

I'll try this one

Spammy 301 redirections + .php spam

Power Member

BANNED

Elite Member

Newbie

BANNED

Newbie

Junior Member

Power Member

Elite Member

Power Member

Elite Member

Power Member

Elite Member

Power Member

Elite Member

Banned - Multiple Rules Violations

Power Member

Elite Member

Power Member

Main Menu

Marketplace

Making Money

BlackHatWorld

Other