Web page redirect through Networks?

A web page/forum that I frequent numerous times at work gets redirected to an ad page that has links for other pet products.

I've talked to others who frequent this page, and those who are on a network from school or work are also getting redirected.

If we remove the 'www' from the url, occasionally we are able to get to the page, but not able to login.

I've logged in on other machines on my work's network and get the same result. I also asked an IT person to login under their identity and the same thing happens.

None of us have a problem when logging onto the site at home.

Could our networks's DNS servers be affected?

Please help by posting your opinions of what it could be. I'm worried that our network is compromised and that the IT folks aren't aware or don't have a clue of what to do.

FB

Sounds more like a b0rked hoster.. The hosting provider hosting that site that is..
Maybe you can post the site here.. We'll have a look. If we get the same deal, you know enough..

Yes, it does sound rather like a problem at the hosting server, but it is strange that it doesn't happen from home. However just a few questions/things to try.

1. Check your Hosts file to make sure that the redirect isn't there.
2. Try connecting through a proxy.
3. Does this happen with different browsers (IE, FF, Opera)?
4. Is it time dependent? Like can someone connect from home OK during office/working hours?
5. Try adding a redirect from the advert page to the page you want, in your Hosts file.

SirDice,
The site is http://www.capitalcichlids.org. The link on the left, 'forum' is the only one affected. None of the other links take you to the ad.

Nihil,
I'll have to check your items when I get to work. (6am) Although, I have been home all day and have had no problems with interacting with the site whatsoever. no one else either.

If you can't get the ad from the url provided, I'll post a screen shot of the ad and the source page for your review.

Thanks,
Franny

Quote:

---

Originally Posted by Franny

SirDice,
The site is http://www.capitalcichlids.org. The link on the left, 'forum' is the only one affected. None of the other links take you to the ad.

---

The forum link is pointing to a webfolder on the same site so we can rule out any dns issues.

Does the forum show (part of) the last postings if you login?
Then it sounds like someone is injecting some XSS or a redirect on the board.
Mods clean it, it goes away until it gets spammed again.

It seems to work OK right now. It just took me to the Forum.

I tried the direct forum link and the cached versions with the same results.......... no redirects.

SirDice, they are using IPB 2.2.2 which does have XSS vulnerabilities if it hasn't been patched.

EDIT: I got the same results with FF and IE7

To me, it looks like the there's a sub-domain entry in our DNS record that's wonky. I have to figure some way to specify that all sub-domains (i.e. *.capitalcichlids.org) all refer to the same server, and thus website.

It's also probable that our hosting company serves multiple websites on a single server, and uses some mechanism to determine which domains serves up which webpages on their server. I'll contact the hosting company and make sure that both capitalcichlids.org and www.capitalcichlids.org all point to the same webpage/account on their end. Google should pickup those changes.

AND take care of those XSS vunerabilities.

Thank you guys so much!

Franny

You could use wireshark to grab the session on the computers that have this problem. You should then be able to see exactly what or who is causing the redirect. If it is DNS, it'll tell you which servers, etc. If it's XSS, you'll see the code.

If you suspect your DNS servers, change from your internal DNS servers to your ISPs, or better yet, some DNS server that isn't on your company or ISP's network.

I'm with sirdice on this though. I don't think it's dns either. Both the site and the forum are on the same server.

Quote:

---

Originally Posted by Franny

To me, it looks like the there's a sub-domain entry in our DNS record that's wonky. I have to figure some way to specify that all sub-domains (i.e. *.capitalcichlids.org) all refer to the same server, and thus website.

---

Forget DNS as it isn't the problem. The site is on http://www.capitalcichlids.org and the forum is on http://www.capitalcichlids.org/forum/. Both use www.capitalcichlids.org and doing so point to the same IP address. No DNS funny business possible. If it was DNS the front would have the same effect.