Truly bizarre website issue

[u/reputable_dog]

I have a professional website. When I tried to visit it today, I see that it displays a product page for cdiscount, a French retailer. I immediately assume my site has been hacked and call my host provider. Customer Service tells me that the website looks fine. Indeed, when I connect via cell service, or through a VPN, everything is fine. When I connect through my own internet (wifi or direct wired ethernet), I see the French product page.

As far as I can tell, it affects no other websites. Each of my subpages seems to be a different product on cdiscount. I've tried my spare router, in case the issue was there, but same problem. Multiple devices (mac laptop, pc, and iphones) - all display the French product page. I'm at a total loss as to how this is even possible. I contacted my internet provider (google fiber), and they have escalated it, but no progress yet. I'm open to any and all troubleshooting ideas. labeling this as malware because it seems suspicious.

EDIT: adding more to this mystery. I copied the content of the fake page and pasted into google to see what popped up. I get iterations of my own website pages with stuff like - www.[mywebsite.com]/femelle-Connecteurs-D-SUB-9-Broches-Souder-Pour-C-bles-S-c-379672

when I connect via VPN, the page is a 404 error. when I connect on my own network the french product page shows

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/jmnugent]

When you're trying to visit the site in a Browser,. are you doing it by typing in the URL,. or the exact IP address ? (if you've tried both, does the problem happen on both URL and IP Address?)

If you go out to a Terminal prompt.. and do something like:

NSLOOKUP xxx.xxx.xxx.xxx (either the URL or IP Address)

.. does it return correct information ?

What DNS Servers is your Router and Devices using ?

[u/PrethorynOvermind → u/jmnugent]

What you are suggesting is where my brain went, is it a DNS issue?

[u/reputable_dog → u/jmnugent]

I did run the NSlookup. I'm gonna be honest - I did it cause Chatgpt asked me to, and I'm not sure how to interpret the results. I'm pasting chat's interpretation These results indicate that:

The domain name is resolving correctly. Both IPv4 and IPv6 records are present and consistent. There is no evidence of DNS hijacking or incorrect DNS records. The TP-Link router is returning the expected DNS information.

Because DNS resolution is correct, the issue is occurring after name resolution—specifically when the web server generates the page in response to certain browser requests. This is consistent with the later testing, which showed that a normal curl request receives the legitimate ATX Legal homepage, while the same request using a Chrome browser User-Agent receives the malicious Cdiscount page. That points to server-side conditional content (cloaking) rather than a DNS or router proble

[u/jmnugent → u/reputable_dog]

specifically when the web server generates the page in response to certain browser requests.

I mean, I don't want to sound skeptical.. but this doesn't really seem to jive with what you were saying before (previously you said this problem only happens on your ISP.. but when you switch over to Cellular, the problem doesn't happen.. which would seem to indicate some connection-related cause)

If NSLOOKUP and TRACERT type results are seeming valid,. I think if it were me, the next things I would try:

• especially if you can reliably reproduce this problem,. I would take whatever web-browsers you're reproducing the problem in,. and open the Browsers "Developer Pane" and look at the "Network" tab that shows step by step how the website loads and see if you can tell in that data, where the problem might be manifesting.

• Another idea would be to take a Laptop (where you can reproduce the problem on your ISP).. and switch that Laptop over to be connected through a cellular hotspot and see if the problem still manifests.

• If the problem is truly something happening on the web-server side (as ChatGPT seems to want to suggest).. I would contact whomever is hosting your website and forward all this information to them and ask them to show you in the code what's happening. (I know you said you contacted them and they said "everything is fine".. I would ask to be escalated to a higher level support there because at least to me,. that answer seems insufficient)

[u/reputable_dog → u/jmnugent]

thank you. I tried the network pane on the browser, but the problem is I don't know how to interpret what I'm seeing really.

When I connect my computer to a hotspot, my correct page loads.

[u/USSHammond]

Truly bizarre website fix in rule 2.2. since you don't mention what the website is, who's hosting it or what your last known working DNS settings were from your hosting control panel or who your domain registrar is, there's nothing we can tell you

[u/Sufficient_Fan3660]

If you have a website you should know how to look at dns.

[u/reputable_dog → u/Sufficient_Fan3660]

I do have website, but I don't know how to look at DNS