Hi everyone,

Just to add some information and maybe get some help ourselves with this issue. We host 100+ DNN sites and we stumbled upon the multiple-portal-aliases-out-of-nowhere problem ourselves last week.

We believe the attack works the following way:

Sites that have a particular IP setup for SSL purposes, get called from a spoofed DNS that then sends the request to our server with the wrong URL for that IP.

Since the Auto Add Alias option was enabled, the alias is added to the portal alias table.

We found everything from appspot.com sites, to AWS buckets on our portal aliases, also a Russian drug selling site and a lot of gibberish. We also found what it would seem actual child portal URLs on the site, but weren’t configured at all on the rest of it. And we also found what would look like DNS and NS URLs from URLs we hadn’t heard of, but were actual pages (for example, a realtor site from California).

We have, since then, disabled this option in all of our sites

What we cannot find is a reason for this to happen.

Is it some kind of site hijack that stopped on the midway point? (No content has been uploaded to our sites, so we are not getting our bandwidth leached, nor are we hosting anything for someone else).
Are they trying to legitimize URLs by pointing them to non-black-listed IPs?
Are they trying to get us black-listed by pointing their sites to our IPs?
Is this just some kind of drive by attack performed by an attack bot and we just got sprayed with some half-assed attempts at site hijacking?

We don’t have a lot of experience with black hat stuff, so we are not really sure what this is all about. We have cleaned up the portal aliases tables and disable the Auto Add setting but we really want to know if we patched the issue, or if we just fixed one side of a much bigger issue.

Any help will be much appreciated.


Thanks!