Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the web app that I am running locally on apache. The webpage was identical to my webapp but all links were pointing to the malicious website.
I do not understand how this can happen. Here is some relevant info:
OS:
Ubuntu 16.04 LTS
Apache version:
Server version: Apache/2.4.18 (Ubuntu)
Server built: 2019-09-16T13:13:53
The web app is a PHP7.0 Symphony web application.
Netstat:
u@u:~$ sudo netstat -apn | grep apache
tcp6 0 0 :::80 :::* LISTEN 9711/apache2
If I am understanding the netstat output correctly, apache is bound and listening to all ipv6 interfaces (I am not sure why IPv4 is missing?)
However I am behind a router which should block incoming connections (I have checked in my router that there are no port forwardings/open ports). I also tried accessing my public IP from a different network and getting connection refused (as expected).
I am very confused (and alarmed) by this. Anybody has some idea how this could happen?
I am happy to provide more info/clarification. I imagine it is not allowed so I will not post the link to the malicious site, although some security professionals might be interested in checking it out?