Author Topic: Test page centos hijack my facebook...  (Read 3948 times)

0 Members and 1 Guest are viewing this topic.

Offline
*
Test page centos hijack my facebook...
« on: June 24, 2020, 12:03:32 AM »
Hi

Every time I try to share on facebook (via post os simply sending a message to a friend) my website www.sickdogsurf.com it pops up the testing page of centos in the facebook preview (see here https://paste.pics/87d249c940f18ba132971173dfd811d0 ). I tried to fix this with official support, but it appears not to work...

Funny enough, if I share https://www.sickdogsurf.com , the testing page doesn't appear...

Support seems helpless, any idea?

Thanks a lot!!!
Roberto

Offline
*
Re: Test page centos hijack my facebook...
« Reply #1 on: July 16, 2026, 10:24:10 PM »
Did you ever find a solution? I am facing the same problem!

Offline
*
Re: Test page centos hijack my facebook...
« Reply #2 on: July 20, 2026, 05:53:39 AM »
Removing index.html from /public_html/ MIGHT help.

Offline
*****
Re: Test page centos hijack my facebook...
« Reply #3 on: July 21, 2026, 06:18:26 PM »
Also, you can change your Index directive in Apache or Nginx. I always set it to just index.php (removing index.html and index.htm) unless it is for a static HTML site (much more rarely these days).

Offline
*
Re: Test page centos hijack my facebook...
« Reply #4 on: July 25, 2026, 11:22:47 PM »
Your server is compromised by a backdoor python service which uses a fake apache module mod_auth_form.so Apache module doing SEO cloaking (serves casino/gambling content only to Googlebot, redirects real users via injected JS and returns 206 welcome 131 bytes page.

Unload and delete the fake mod_ath_form module
stop and remove fake ntpd service (the python backdoor)

this is a security problem at the latest cwp version, something with the API. You also need to rotate main passwords (root, mysql, etc)

also you may find that your /root/.ssh/ keys are deleted