Occasionally find http://safesrv.netwww. in front of my domain

Portal Home > Knowledgebase > Articles Database > Occasionally find http://safesrv.netwww. in front of my domain

Posted by chilli, 01-31-2013, 01:26 PM
For some time now, when I get activation emails through from my forum I sometimes get a link with http://safesrv.netwww. in front of my normal domain url. I am assuming this is not normal? Anyone else ever come across this? I was going to move the site to my VPS but if there is a problem I would rather clean it up before I do that. Tried googling the above and comes back with a lot of links...so it's obviously on many other sites, but nothing about malware or it being dodgy in any way. Anyone know what this is?
Posted by TravisT-[SSS], 01-31-2013, 03:11 PM
More info on server setup would help. That is not normal at all. Have you tried doing a search on the box for that string to see if it is located somewhere?
Posted by chilli, 01-31-2013, 03:35 PM
The site is actually on my shared reseller account at the moment. In fact it's been there for the last 10 years. I did search through the database and files but could not find anything so I assume whatever it is, is using some sort of obfuscation to generate that prefix so I cannot locate it in the site files. I am guessing the aim is to enable spam links to others sites? nut i am surprised there is not mention of it in terms of malware on the net.
Posted by APX, 01-31-2013, 07:17 PM
That is very odd. Do you have any services with safesrv. Talk to Keith from safesrv.net. He is a good guy. Maybe you guys can figure this out.
Posted by chilli, 01-31-2013, 07:23 PM
No I don't have any services with safesrv but will take your advice and have a chat with them about this. Perhaps something was installed on the server that I am unaware of.
Posted by SafeSrv, 02-01-2013, 07:41 PM
Hey there - this is rather odd - can you tell me exactly what sort of activation emails ? Im kind of baffled s to why my url would end up in yours. Cheers Keith
Posted by chilli, 02-01-2013, 08:03 PM
Yes so am I. We have admin approval needed when anyone registers on the forum so these are the approval request emails. This doesn't happen all the time. it seems to be completely random. We also used to get other odd prefixes but these seem to have stopped since I beefed up security.
Posted by SafeSrv, 02-01-2013, 08:18 PM
I just noticed you said this has been there for 10yrs, i bought the domain around 2yrs ago so im not sure what previous owners where up to. Seems theres a few around google.
Posted by Website themes, 02-02-2013, 09:34 AM
Can you post an example email?
Posted by chilli, 02-02-2013, 09:38 AM
Sorry, should have been clearer. The site has been there for over 10 years. The issue with the link prefix has only been present over the last 6 months. Will post an example later as i am not at the home computer at the moment.
Posted by joshcombs, 02-02-2013, 11:27 AM
Are you the only one getting this redirect?
Posted by chilli, 02-02-2013, 11:45 AM
No, sometimes if someone posts a reply or new topic on the forum and I receive a notification of that posting it is in the link to it.
Posted by chilli, 02-02-2013, 11:51 AM
This is an example of the email I receive when someone posts a reply on the forum. Note this doesn't happen all the time and in fact most of the time the links are normal.
Posted by joshcombs, 02-02-2013, 12:19 PM
do you have any specialized dns functions for your domain? Because it is wierd that the site is resolving when actually going to http://safesrv.netwww.yamahaforums.c...forum.php?f=55 So there must be a mix up/ dns pointer allowing this to happen. Are you by any chance getting reseller services via SafeSrv?
Posted by chilli, 02-02-2013, 12:37 PM
No but I have reseller services with Heart Internet if that sheds any light on the subject?
Posted by Website themes, 02-02-2013, 12:41 PM
It's time to contact them then. It looks like they've setup wild card sub domains. Tell them to remove those and keep just one sub-domain www.

Add to Favourites Print this Article