nginx: Domain I do not own points to my website

Question

I just noticed that a random domain points to a website I own and the website is fully accessible through that random domain. Is there a way to handle that?

I am using nginx as webserver and hosts are resolved by domain. Moreover, I also use CloudFlare for the website.

I understand that anyone can point a domain to anything, but probably there is a way to handle it.

I have setup this config for my nginx default server, but that domain still goes through:

server {
    listen      80 default_server;
    server_name _;
    return      444;
}

UPDATE: All server configurations (Removed/edited irrelevant parts)

server {
    #listen 443 ssl http2;
    listen 80; # http2;
    server_name domain1.tld www.domain1.tld;
    root /usr/share/nginx/domain1.tld/public;
    index index.php index.html index.htm;
    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
         # root /usr/share/nginx/html;
    }

    # pass the PHP scripts to FastCGI server listening on the php-fpm socket
    location ~ \.php$ {
            try_files $uri @missing;
            fastcgi_pass unix:/run/php/php7.0-fpm.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;

    }

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
        }

}
server {
    #listen 443 ssl http2;
    listen 80; # http2;
    server_name domain2.tld;
    root /usr/share/nginx/domain2.tld/public;
    index index.php index.html index.htm;
    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
          #root /usr/share/nginx/html;
    }

}
server {
    listen 80;

    root /usr/share/nginx/domain3.tld/public;
    index index.php index.html index.htm;
    server_name domain3.tld;
    include /etc/nginx/snippets/restricted;
    location / {
        try_files $uri $uri/ /index.php;
    }

}

server {
  listen 80;
  #listen 443 ssl http2;
  server_name domain4.tld;

  root /usr/share/phpmyadmin;
  index index.html index.htm index.php;
}

server {
    listen      80 default_server;
    server_name _;
    root /usr/share/nginx/domain1.tld/public;
    return      444;
}

server {
    listen 80;
    listen [::]:80;
    server_name domain5.tld www.domain5.tld;

    include /etc/nginx/snippets/letsencrypt-acme-challenge.conf;
    include /etc/nginx/snippets/block_agents.conf;
    location / {
        rewrite ^ https://www.domain5.tld$request_uri? permanent;
    }
}

server {
  listen 443 ssl;
  server_name domain5.tld;

  include /etc/nginx/snippets/ssl-params.conf;
  include /etc/nginx/snippets/ssl-domain5.tld.conf;
  include /etc/nginx/snippets/block_agents.conf;
  return 301 https://www.domain5.tld$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.domain5.tld;
    root /usr/share/nginx/domain3.tld/public;
    index index.php index.html index.htm;

    include /etc/nginx/snippets/ssl-params.conf;
    include /etc/nginx/snippets/ssl-domain5.tld.conf;
    include /etc/nginx/snippets/block_agents.conf;
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ /.well-known {
        allow all;
    }

    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
          #root /usr/share/nginx/html;
    }

    location ~ /\. {
      deny  all;
    }
}

upstream php-handler {
    server unix:/run/php/php7.0-fpm.sock;
}

server {
    listen 80; #443 ssl;
    server_name domain6.tld;

    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    root /usr/share/nginx/domain6.tld/public;

    location /.well-known/acme-challenge { }

    client_max_body_size 512M;
    fastcgi_buffers 64 4K;
    gzip off;
    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;

}

server {
    #listen 443 ssl http2;
    listen 80; # http2;
    server_name domain6.tld;
    root /usr/share/nginx/domain6.tld/public;
    index index.php index.html index.htm;

    #include /etc/nginx/snippets/ssl-params.conf;
    #include /etc/nginx/snippets/ssl-domain2.tld.conf;

    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
          #root /usr/share/nginx/html;
    }
}

question was answered before: https://serverfault.com/questions/527156/setting-nginx-to-catch-all-unhandled-vhosts — Tamerlan Abu, Nov 26 '17 at 09:34
@TamerlanAbu did that, no changes. A weird thing is that nginx seems to be ignoring the `default` server block as it keeps displaying the default page, even though i changed the file. It does complain if I misplace a character in the config though. — Comforse, Nov 26 '17 at 09:39
Have you checked with `nginx -T` that all configuration files are properly read by nginx? — Tero Kilkanen, Nov 26 '17 at 14:21
Have you checked from the other domain if the web page has perhaps an iframe which loads contents from your domain? Have you checked if that domain proxies your domain's content? — Tero Kilkanen, Nov 26 '17 at 18:01

score 0 · Answer 1 · answered Nov 26 '17 at 09:35

0

You haven't declared this as the default server.

listen   80   default_server;

would be the correct form.

See http://nginx.org/en/docs/http/server_names.html and http://nginx.org/en/docs/http/ngx_http_core_module.html#listen

answered Nov 26 '17 at 09:35

Sven

98,649
14
180
226

Did that since I asked the question, no changes – Comforse Nov 26 '17 at 09:41
Add your other `server` blocks and show us log files. – Sven Nov 26 '17 at 09:41
updated. In terms of logs, there is absolutely nothing in the nginx's error.log or in syslog. – Comforse Nov 26 '17 at 10:09

nginx: Domain I do not own points to my website

1 Answers1