Forum

Got a weird problem with my nightskyobserver.com domain. It's intermittently redirecting to random IP addresses. There's nothing on those destinations, just a message like:

"Oops! Google Chrome could not connect to 95.211.217.68
Try reloading: 95.211.217.68"

95.211.217.68 is not one of my IP addresses.

The redirection is occurring before the index.php file on my site is even executed. I've been working with my webhosting company to see if we can find the trigger point, but no luck so far.

I was wondering if the redirection could be happening at Dynadot, with the domain being randomly forwarded to other IPs. Could this be an indication that a hacker has compromised Dynadot in some way?

And is anyone else seeing this type of behaviour on their own sites?

No, everything seems to working properly on our end.  The IP lookup shows that the domain is pointing to the third party name servers and their IP address.  

https://www.dynadot.com/domain/ip.html?domain=nightskyobserver.com

If it's being redirected, it's likely on your host's side.  How long has the redirection been going on?  If your hosting account is compromised, could your hosting provider restore it to a point that doesn't have the redirection?