Site désactivé suite à des fichiers malveillants

Hello @DenisD19

Since you’re no longer going to use your VPS, you can clean it up. To make it clearer, let’s split it into two parts:

1. What to do with the current records?

The DNS zone of your domain duvoye.fr contains all records, including those that pointed to the VPS you want to remove and the mail‑configuration ones.

Delete what points to the VPS :right_arrow: You can safely delete all A, AAAA and CNAME records that pointed to your old VPS. They won’t affect the sites you have on the multisite, as long as those are correctly configured on the shared hosting.

Don’t touch the MX and mail records :right_arrow: The MX records (mx1.mail.ovh.net…) are what make your emails work. If you delete them, you’ll stop receiving mail :confounded_face: Leave them as they are. Also don’t delete the SPF, DKIM or DMARC records, which are important so your emails don’t end up in spam.

2. And what about the subdomains I want to use?

For asf.duvoye.fr, bateau.duvoye.fr…, to work with your hosting, the main action isn’t in the DNS zone but in the multisite section of the client area.

Finally, wait for DNS propagation; it can sometimes take up to 24 h for everything to settle.

Let us know,
Sergio Turpín

Thanks for your help: I did a bit of cleaning—removed all A and AAAA records in the domain’s DNS zones… here’s what I get for the domain’s DNS zones: there are still many left:

Now here’s what I have for the multisite hosting: it’s much cleaner, but the A and AAAA records are greyed out, so they’re not active yet; I’ll wait 24 hours.

Regarding email: I had an Email plan with the VPS, so the associated redirects are on the domain.
I see that in the multisite hosting, I also have an email account, but I can’t activate it while the other one is active…

However, the one in the Email menu works:

I suppose I can’t have both at the same time on the same domain… which one should I keep? In the end I’d like a single contact address for site visitors: webmaster@duvoye.fr, forwarding to my Gmail and an autoresponder if possible.

For now, the sites are no longer accessible.

Hello @DenisD19

Okay, the steps I recommend you follow are the following:

  • Add the A records in the DNS zone :right_arrow: Go to the DNS zone of your domain duvoye.fr and add an A record that points your domain duvoye.fr and another for www.duvoye.fr to the IP of your hosting.
  • Activate email on the hosting :right_arrow: To do this, go to the mail section associated with your web hosting and enable the email option for duvoye.fr. This will automatically deactivate the VPS mail service.
  • Set up the redirect :right_arrow: Once activated, you can create the redirect from webmaster@duvoye.fr to your Gmail account.

Best regards,
Sergio Turpín

Hello,

There are many questions in a single post:

That's normal; you have deleted the A‑records for @.duvoye.fr

Nevertheless, there's something strange: you appear to have two hosting services activated for your domain duvoye.fr: cluster127 and cluster129.

There's also another issue. You say the emails were on your VPS, whereas they have been received on the OVH shared hosting at least since June 15 2022 (source: https://dnshistory.org/historical-dns-records/mx/duvoye.fr.)

Finally, your site was indeed hosted at Contabo, then Google, then an OVH VPS at least until 2021. (source: viewdns.info )

After that I'm not sure.

In your control panel you indeed have two hostings. Look at the left column, once: duvoye.fr and once: mrfhurs.cluster027....

That's probably why your e‑mails can only be activated on one of the two hostings but not the other...

Please be as precise as possible in your questions, because they're getting a bit all over the place...

Hello Sturpin

I reactivated an older version of my DNS zone. I recovered access to my sites. Then I removed only the addresses of the sites that were no longer used. Unfortunately I understood that I could remove them all, because they appeared in domain names and also in the DNS zone of the domain . ERROR

Regarding the VPS email, it is disabled I think. But the Email option remains enabled on cluster 029, which is an old free hosting, too small, that I no longer use and for which I requested termination some time ago. I don’t know why it’s still there.......

So I’ll try to disable this Email function on cluster 029, and maybe I’ll manage to enable Email on cluster 027.......; for now that’s not possible. response: an email already exists for the domain duvoye.fr ..........

I had thought I could remove them in the “domain name” section since they also existed in the “hosting” section!!

Nevertheless, there’s something odd: you appear to have two hosting accounts activated for your domain duvoye.fr: cluster127 and cluster129.

Cluster129 corresponds to an old free hosting plan whose space was too small. I therefore signed a contract for a new hosting plan, cluster027, which hosts my sites today. I think email is active on cluster129.
I will try to

  • set up email on cluster029
  • disable email on the VPS
  • enable email on cluster027

In any case, your site has indeed been hosted on Contabo, then Google, then an OVH VPS at least until 2021. (source: viewdns.info)
Indeed,

  • I started with an all‑in‑one hosting from another provider
  • on the advice of a friend (my site was not secure at all) that I followed, my sites were on a VPS, because I tried to use a virtualised system (Docker + Docker‑Compose + another thing to hide the sites behind). The solution turned out to be far too complicated for my skills.
  • now I’m moving back to a multisite contract that is much simpler for me to manage, but already hacked…
  • if I learn from our discussions today, then it will be easier for me in the future and it seems simpler once OVH is configured, with less to touch!!

In your control panel you indeed have two hosting accounts. Look at the left column, once: duvoye.fr and once: mrfhurs.cluster027....

  • cluster027: that’s where my sites are
  • duvoye.fr: that’s my domain name but it has never actually contained a site. I get the impression that, like in my DNS zone, this thing was created a bit on its own

Tell me whether what I’m doing is right or not:

  • I re‑used a configuration from about 5–6 months ago for the DNS zones, thereby retrieving my sites that are on cluster027
  • I’m looking on duvoye.fr, cluster029, and the VPS in case I might have a mail solution for the duvoye.fr domain
  • if that’s the case, I will shut down that mail solution
  • and then I could move it back to cluster027

Once again, thank you for your help and patience

Denis

PS: it seems that cluster029 has changed its name!!!!!! and is now called duvoye.fr!!!!!!!

You choose whatever name you like, using the little pencil next to the title when you open the “hosting” panel.

This lets you identify them more easily.

So you have acquired a free hosting plan (start10m, start100m, or mailplan) when you purchased your domain. This free hosting includes a single mailbox.

You need to retrieve your emails and then cancel this free hosting that is preventing you from doing what you want. Unfortunately, this start100m will remain “in purgatory” for a month, and you still won’t be able to activate your mail on the other hosting.

You should open an incident ticket with OVH asking them to delete this cancelled hosting immediately and permanently; you can even request that they erase the mailbox and its contents. This will avoid a possible back‑and‑forth question.

For now: I'm going to delete the Emil>duvoye.fr< (it's the only place where I found a delete):

It replies:

I don't know why

or maybe it needs some time to think???

This is your hosting (make sure it’s the one to delete, okay!).
The email box is linked to it.

I have a termination date of 04/03/2027 ............ so the thing won’t disappear!!!

Indeed, Email is shown as active
But I can’t deactivate it

Good evening @DenisD19

Create an Incident ticket:

Manager OVH > https://www.ovh.com/manager/#/dedicated/useraccount/dashboard > My support requests > Create a request / ticket

then:

Call OVH support on Monday at +33 9 72 10 10 07.
Preferably between 8 a.m. and 9 a.m., or around 3 p.m., there is less waiting.

Or on Twitter @ovh_support_fr or #OVHcloudsupport

Thank you

I will follow your advice and keep you informed of the result.