A domain I've never heard of resolves to my website

Question

I've discovered (via looking at mod_pagespeed cache entries) that a completely random domain I've never heard of before is resolving to my website.

If I visit this domain, my website loads. The DNS for that domain is pointing to my server's IP.

Right now in my vhost config I have *:80, which I'm guessing is where I'm going wrong.

I immediately changed this to example.com:80 where example.com is my domain. Assuming this would mean the server would only respond to and fulfil requests for my domain name, rather than any request on port 80.

My original vhost config;

<VirtualHost *:80>
    DocumentRoot "/var/www/example.com"
    <Directory "/var/www/example.com">
        Order allow,deny
        Allow from all
        Allowoverride all
    </Directory>
</VirtualHost>

My new tried config;

Listen 80
ServerName example.com

<VirtualHost example.com:80>
    DocumentRoot "/var/www/example.com"
    <Directory "/var/www/example.com">
        Order allow,deny
        Allow from all
        Allowoverride all
    </Directory>
</VirtualHost>

When I tried to restart apache with the new config I got the following error:

 * Restarting web server apache2 [Fri Mar 28  08:55:47.821904 2014] [core:error] [pid 5555] (EAI 2)Name or service not known: AH00549: Failed to resolve server name for 152.155.254.241 (check DNS) -- or specify an explicit ServerName
(98)Address already in use: AH00072: make_sock: could not bind to address [::]:80

Note: The IP beginning 152 in the above error has been slightly edited, but the original wasn't my server's IP address anyway.

Can anyone offer advice on this issue? Is the domain (actually there's a couple) that is resolving to my website innocently just the previous user of the dedicated server, whose DNS is just still pointing to it? How can I resolve the apache virtual host config issue, and any other advice is welcome.

Thanks.

Answer 1

There's probably no harm in having those other domains pointing to your host, except of course that it increases the load on your server. If you want to block them, set up new virtual hosts for them:

NameVirtualHost *:80
<VirtualHost *:80>
    ServerName example.com
    # example.com configuration
</VirtualHost>
<VirtualHost *:80>
    ServerName baddomain.com
    Deny from all
</VirtualHost>

Instead of Deny from all you could use Redirect permanent /error.html to show them a custom error message.

You could repeat the second VirtualHost for each domain you want to block, or if there are a lot of them, put it first to make it the default VirtualHost, and make exceptions for your domain(s):

NameVirtualHost *:80
<VirtualHost *:80>
    # default VirtualHost
    Deny from all
</VirtualHost>
<VirtualHost *:80>
    ServerName example.com
    # example.com config
</VirtualHost>

As for your error messages, it seems that Apache couldn't resolve the hostname example.com when it started, or couldn't find your ServerName directive. Not sure why. The second error says that port 80 is already in use on your host. Did you finish shutting down all of the previous instances of Apache?

Answer 2

Apache serves as a sort of default the first domain you define.

If you want to serve up myowndomain.com with the content you desire and all other domains some behavior (perhaps redirecting to the corresponding page on your preferred domain), define the "catchall" domain first, handle traffic appropriately (I recommend redirecting to your real domain), and then define your real domain etc. with subsequent VirtualHosts.

Answer 3

Regarding "where the heck did this other name for my website come from", anyone can put any A record they like at any name below a domain they control. You can investigate a little by using whois to find out who has registered the second-level domain containing the offending DNS name.

Answer 4

Your best bet here, if you really want to avoid random domains being pointed to your website, is probably as Andrew Schulman has answered and BeowulfNode42 has commented:

Serve a default vhost. You have a few options here, but to be clear I disrecommend serving a plain error page since it may make troubleshooting a pain later.

• Serving up a bland "Under normal circumstances you shouldn't see this, please contact blah blah for help." sort of message. That way if something undesired does happen later (misconfigurations do happen) you'll have a useful fallback.
• Redirecting with 301 to your actual domain/website, though if certain issues do arise you could end up with a redirection loop.
• Have some sort of mini-site that then directs the user to your actual website, perhaps explaining that the domain they've hit is "no longer in use".

So, leave your vhost configuration as it was, but create a new vhost for the actual website, swap the directories around, and keep going.

Given what you've said about recently taking over the server, I would consider making sure (unless the domain clearly isn't yours) that this isn't some forgotten leftover that needs to be taken off autorenewal, or that it isn't part of some project that isn't yet complete or was abandoned.

Answer 5

You should always put the default VirtualHost first, as in @Andrew Schulman second solution.

That way you can keep all the requests that are not for your site in different log files using CustomLog and ErrorLog in the config - you don't want that in your logs if you are using AWStats or another program to create your stats.

Also a lot of (most?) attacks will come at your IP and not at your hostname. Again this will keep your real site logs clean and reject them straight with the deny from all.