If your website sends visitors to an unfamiliar domain, treat it as a possible security incident and preserve evidence before you clean it. A redirect means a visitor requesting your address lands on a different address, which can signal hijacked DNS records or injected site code.
CISA warned that attackers hijacking DNS change A, MX, or nameserver records to redirect website and mail traffic to attacker-controlled infrastructure, in a global campaign alert. In one enforcement case, the FTC said hackers changed logins and redirected visitors to an unaffiliated adult site, in a case summary. Save proof first, then investigate and report.
Table of Contents
- What should you save before fixing anything?
- Does a redirect always mean you were hacked?
- What details do incident reports require?
- Where should you send the documentation?
- Frequently Asked Questions
What should you save before fixing anything?
Record the full redirect path exactly as visitors see it. Copy the starting URL, every intermediate URL, and the final unfamiliar domain. Note the date, time with time zone, browser, device, network, and whether the redirect happens on desktop, mobile, or both. Preserve technical traces that disappear after cleanup. Save response headers, page source, DNS records, WHOIS output, nameserver assignments, and certificate details.
Take timestamped screenshots and screen recordings showing the address bar, page content, and security warnings. Keep original files untouched. Export logs from hosting, DNS, CDN, and firewall controls. NIST's incident-handling guide calls for a Detection and Analysis phase that records what happened, actions taken, timestamps, and evidence, described in NIST SP 800-61 Rev. 2.
Does a redirect always mean you were hacked?
No. A redirect alone does not prove hacking. Google notes that traffic drops and sneaky mobile redirects need Security Issues confirmation and can come from ads or injected code, explained in a mobile redirect guide.
Check Google Search Console Security Issues for hacked pages Google detected. Screenshot the findings, affected URLs, sample code, and notification dates. Compare clean and affected pages, test multiple browsers and networks, and ask whether a recent ad script, plugin, theme, or DNS change matches the start time.
What details do incident reports require?
Build one timeline with discovery time, first suspected start, actions taken, and people involved. CISA asks cyber-incident reports to include date, time, location, activity type, number affected, equipment involved, organization name, and a point of contact. Gather those fields before filing so registrar, host, and law-enforcement forms match.
Include scope and impact in plain terms. List affected domains, subdomains, email delivery problems, customer complaints, lost transactions, and credential-reset needs. Attach your redirect URLs, headers, DNS and WHOIS records, screenshots, log excerpts, and Search Console findings.
Where should you send the documentation?
Report the incident to CISA with your timeline and technical evidence. File a separate complaint with the FBI's IC3 at ic3.gov. The FBI says IC3 reports support investigative and intelligence work and rapid reporting can support recovery of lost funds.
Notify your domain registrar, DNS provider, hosting provider, and certificate issuer. Give each provider the affected domain, exact redirect chain, timestamps, DNS and WHOIS records, recent account changes, and permission to check logs. Change exposed passwords, review authorized users, lock domain transfers, and keep every confirmation number with the case file.
Frequently Asked Questions
Should I clean the site before reporting?
Preserve URLs, headers, DNS records, screenshots, and logs first, because cleanup can overwrite the proof providers and investigators need.
What if only some visitors see the redirect?
Record device, browser, location, network, and referring page for each report, since mobile-only or ad-driven redirects behave differently from sitewide hijacks.
You Might Also Like
- Website Outage vs. Data Breach: Why Downtime Alone Does Not Establish Data Theft
- WordPress 7.1.2 Security Flaw: What the Advisory Says About Exposure and Breach Evidence
- How to Verify Ransomware Attacks Claims in 2026: breach notices and security advisories, Evidence, and Red Flags