How It All Started #
I used to have a personal website. One that I would use for small, self-hosted projects. I had intended to make it more like a portfolio website at some point as well. In time, I stopped using the website and the domain with it.
I recently was inspired to do some work that would be perfect for my personal website. Something blog-like and simple but gives a whole new face lift to the page. I would repurpose the old domain, give it new content, and attempt to publish there.
After doing all of the work and creating some content for the new site, I hit deploy in GitLab. Then I could not access it. I tried accessing the home page on my laptop and my phone, both on and off of WiFi. No success.
What gives?
The Investigation #
I own the domain and have for many years. So I was not worried that someone had stolen my domain for malicious purposes. Instead, I started by ensuring I had everything configured correctly at my DNS provider. In this case, my domain was purchased through one provider and then redirected to Cloudflare for handling DNS records.
In the Cloudflare dashboard, I was able to go to DNS records and see no issues. In fact, I used LowellBuildsIt.com as a model to base the new site off of. It uses GitLab pages and has a custom domain set. All seemed correct at first glance.
What I did next was attempt to access the website on my phone. Maybe for some reason, my laptop was just struggling that day. Nope. My phone also could not reach the site. I thought it might be a dumb test, but I disabled WiFi on my phone, disabled my VPN, and tried again. Page loaded.
Now I knew something was wrong on my home network, not the website itself. But what? I spent some time digging through OPNSense firewall logs and found nothing of interest. What about local DNS? I use Adguard on my OPNSense router to block malicious domains and aggressive advertisers. So I looked through the query log and found the domain was being blocked.
Getting Somewhere #
I had dealt with bad domains before. In fact, I have high praise for Adguard’s responsiveness both in this case and previously when I reached out about a domain that was wrongly blocked.
The downside for this case was that the domain was not merely blocked by Adguard. You see, they are downstream of major security list providers. So when I emailed the Adguard team they respectfully told me they would do nothing about my issue because it was an upstream provider who blocked it.
I will avoid the boring details because the next phase is a wash, rinse, and repeat. The upstream was a DNS provider who also uses yet another upstream provider for security blocking lists. So I emailed them too.
Finally, I should be getting somewhere good but it took that upstream provider about a week to respond initially. It took a little convincing, but they unblocked my domain. I thought that everything would be fine now.
It Was Way Worse #
A day passed and I figured I would attempt to access my site again. Did not work. So what now? I investigated a little bit farther by checking virustotal.com. It is a powerful website that pulls together information from a lot of different security providers for files, searches, and website URLs.
I searched my website and sure enough if was flagged by 18 of the 92 scanners for phishing and malware. Great. At least it was not 19 anymore because I had requested the site be removed from one of them. Even still, that was too many.
How did we get here? How did I get flagged for malware and phishing on a website that has not been deployed in years?
Piecing it Together #
It was at this point that I started to work backwards through the ordeal. At one point in time, my domain was assigned an IP address and the website was deployed. That deployment was served up on a Linode provided VM in their datacenter.
I had shut off the VM after it served its purpose and left it there for some time. After that time had passed, I decided to delete the VM altogether because I was not going to revisit it. It was around this point that the scanners on virustotal claimed to discover phishing and malware on my domain. But how?
Then it dawned on me. Linode gives you a static IP address for your VMs. You can access them via their dashboard or if you enable SSH, even your terminal from anywhere in the world. That is wonderful for access and exposing applications to the internet. What I did not consider is that when I deleted the VM out of my Linode account, that IP address was thrown back into their pool for someone else to pick up.
Even though I had nothing deployed and the domain laid dormant for a long time, it still tied to an IP address. An IP address that someone else picked up when deploying a malicious VM into their own Linode account in order to trap someone into a phishing attack. So when the various scanners saw my website become active again, they saw it had malicious intent and flagged it.
Lessons Learned #
First of all, do not leave your domain dormant, pointing at an unknown IP address. If you are done with a domain either find a good way to point it at some valid site for the time being until you need it again or point it at nothing. All you have to do is remove all DNS records from the domain and this would not be a problem for you.
Second, it is probably best to keep your domain active in order to keep it from appearing malicious or like it has been taken over by someone else. It turns out, one of the scanners on virustotal no longer considers my domain phishing but they do consider it suspicious because it seems to have been dormant and then dramatically changed content and hosting.
Third, sometimes a new project is just that, new. And with a new project, it might make the most sense to get a new domain.
Anyways, if nothing else, I hope you enjoyed my crazy ride through finding out I was banned by multiple security sources for hosting phishing content and malware on a dead domain. I encourage you to be more careful and learn from my mistakes and as always, good luck on your next homelab adventure!