Hello everyone! I would like to bring a critical situation to your attention. Websites hosted on newfold (register.com, web.com, Network Solutions) are vulnerable! Domains with the following DNS servers are vulnerable: dns101.register.com dns102.register.com and are hosted on shared IP 209.17.116.160 (Web.com Group, Inc. ASN: 19871)
An attacker who does not have access to the website domain can use the vulnerability on the hosting service to create subdomains on any website. In this way, they spread their spam (phishing) pages on Google using “black SEO.” Taking advantage of the site's reputation, its subdomain on Google gets high rankings. But over time, the main domain will be penalized by Google and other systems.
Here is a recent example:
The site houstonsleep.net
dns101.register.com
dns102.register.com
209.17.116.160
Web.com Group, Inc.
Subdomain on which spam is published: kone.houstonsleep.net
209.17.116.160
Web.com Group, Inc.
To see all spam pages, enter the search query “site:kone.houstonsleep.net” in Google.
This spam on kone.houstonsleep.net was created by a hacker. The owner of the houstonsleep.net website is not involved in this in any way and does not even know that a malicious person is using their domain for spam. This is not a simple website hack, it is a vulnerability in the hosting! The hacker is exploiting a vulnerability in the hosting panel. Due to the fact that the newfold hosting system has the same DNS servers dns101.register.com
dns102.register.com. Thus, knowing the vulnerability, the hosting itself allows you to attach someone else's subdomain to your panel.
Why did I decide to publicize this and write this post? Because it's ridiculous, I wrote to the hosting support https://www.newfold.com/abuse dozens of times over the course of a month! I showed and described the problem in detail! They replied with template messages and a week later blocked such spam subdomains and the main site (since the owner did not respond). But during that week, the hacker managed to collect traffic from Google from these spam pages and damage the site's reputation.
But they don't solve the problem itself! And as you can see, new spam has now appeared on the subdomain kone.houstonsleep.net
Examples of sites that were previously affected and subdomains that were deleted after contacting support. Enter search queries in Google and you will see old spam pages on subdomains:
site:miasole.com смотреть
site:raouls.com смотреть
site:johncartercash.com смотреть
site:humetrix.com смотреть
site:allanmccollum.net смотреть
The purpose of my post is to publicize and bring the problem to the attention of the senior management of register.com, web.com, and Network Solutions.
Well, now any of your sites on a shared IP on this hosting can be used by a hacker.
An attacker who does not have access to the website domain can use the vulnerability on the hosting service to create subdomains on any website. In this way, they spread their spam (phishing) pages on Google using “black SEO.” Taking advantage of the site's reputation, its subdomain on Google gets high rankings. But over time, the main domain will be penalized by Google and other systems.
Here is a recent example:
The site houstonsleep.net
dns101.register.com
dns102.register.com
209.17.116.160
Web.com Group, Inc.
Subdomain on which spam is published: kone.houstonsleep.net
209.17.116.160
Web.com Group, Inc.
To see all spam pages, enter the search query “site:kone.houstonsleep.net” in Google.
This spam on kone.houstonsleep.net was created by a hacker. The owner of the houstonsleep.net website is not involved in this in any way and does not even know that a malicious person is using their domain for spam. This is not a simple website hack, it is a vulnerability in the hosting! The hacker is exploiting a vulnerability in the hosting panel. Due to the fact that the newfold hosting system has the same DNS servers dns101.register.com
dns102.register.com. Thus, knowing the vulnerability, the hosting itself allows you to attach someone else's subdomain to your panel.
Why did I decide to publicize this and write this post? Because it's ridiculous, I wrote to the hosting support https://www.newfold.com/abuse dozens of times over the course of a month! I showed and described the problem in detail! They replied with template messages and a week later blocked such spam subdomains and the main site (since the owner did not respond). But during that week, the hacker managed to collect traffic from Google from these spam pages and damage the site's reputation.
But they don't solve the problem itself! And as you can see, new spam has now appeared on the subdomain kone.houstonsleep.net
Examples of sites that were previously affected and subdomains that were deleted after contacting support. Enter search queries in Google and you will see old spam pages on subdomains:
site:miasole.com смотреть
site:raouls.com смотреть
site:johncartercash.com смотреть
site:humetrix.com смотреть
site:allanmccollum.net смотреть
The purpose of my post is to publicize and bring the problem to the attention of the senior management of register.com, web.com, and Network Solutions.
Well, now any of your sites on a shared IP on this hosting can be used by a hacker.
