My domain is hosted on a bare-metal Debian server, and DNS still resolves to the server's public IP. A few months ago, changes to the site stopped appearing even when I uploaded or deleted files. Shortly afterward, the entire site was replaced by a black page containing an unfamiliar console-like interface.
The server is reachable, other domains hosted on the same machine work normally, and my hosting provider found nothing unusual. I can still access the expected files over FTP, but changing them has no effect on what the domain serves. I use Nginx and have not intentionally changed the DNS or nameservers.
Could the domain-specific Nginx configuration be pointing to a different document root or upstream? Alternatively, does this sound like the site or server was compromised? I'm trying to determine where the unexpected content is actually coming from.
4 Answers
A black page with an unfamiliar console or interface is consistent with a web shell or injected application, especially since your normal file changes are not being served. Compare the live response with the files on disk, inspect Nginx access and error logs, and look for recently modified files, unexpected processes, cron jobs, and additional accounts. If compromise is plausible, isolate the server and rebuild from a known-clean backup rather than trusting the existing installation.
This could be a compromise limited to that virtual host. Check the Nginx server block for the hostname and verify that its root or proxy_pass setting points to the directory you expect. Also check which configuration files are enabled, whether there are duplicate server blocks, and reload Nginx after correcting anything suspicious.
Check the response from the server directly with a command such as curl, including the Host header for the domain. A 200 response from Nginx confirms that the request is reaching an HTTP server, but it does not prove that the intended virtual host or document root is being selected. Testing from another network can also rule out local caching or interception.
It is also worth confirming that the domain registration itself is active and that the authoritative nameservers are the ones you expect. A lapsed domain can sometimes be redirected or registered by someone else, although if DNS consistently resolves directly to your server and the HTTP response is coming from your Nginx instance, a bad virtual-host configuration or compromise is more likely.
I checked the headers and received a normal 200 response from Nginx. I still need to test from another machine and compare the result with the expected virtual-host configuration.