Answered URLs have ftp. in them. Hack attempt?

I just noticed all my URLs on my site start with ftp. You can see the problem live here: http://ftp.dayton-web-design.com/

I don't know here this is coming from but its recent. I am running revo: 2.3.5 and have looked at the .htaccess file and config.php file. I do not see where someone added the .ftp to my urls.

I am using Wayfinder, but the other links outside of wayfinder also have this ftp attachment. Where can I try and find this setting that is causing this?

What have you got in the base href in the header ?

This is not really an ftp... it's look like an alias of domain name.
Try to display this somewhere :



EDIT : look you got the same things here http://www.dayton-web-design.com/ and here http://ftp.dayton-web-design.com/

In my template header this is my base ref line:


That ftp. has to be added somewhere. I just don't see it anywhere in my templates.

I was trying to look into phpMyAdmin but I do not see which table holds my site_url.

You should contact your host. There may be an error in how the server or your site is configured.

Is this happening in the Manager too?

site_url is not in the DB or any files. It's created on-the-fly based on the URL the user comes in on. Check the .htaccess file for 'ftp', though I suspect that Paulp is correct that it's a plugin. Look for plugins you didn't install (It there's a core services plugin -- that's the problem). As a last resort, you can disable all plugins by right-clicking on them in the Elements tree and see if the problem goes away. Delete all files in the core/cache directory after disabling them and before testing. If that fixes things, you can start enabling the plugins one at a time until the problem comes back.

If none of that works, check the index.php file in the MODX root for suspicious code.

You can add in you checklist, the http_host in the config file : core/config/config.inc.php
There is two place in this file.

Please use an uncached site_url system setting tag. [[!++site_url]]

Otherwise the first client calling the host would set that tag and it is not changed afterwards.

OK, I am not 100% sure how it went away, but the .ftp is gone! I noticed my FormIt plugin was outdated as I took your advice to look at plugins. While I was there I just updated this plugin via the admin and the problem is now cleared up. I am not sure if the problem just cleared up due to a server configuration with my host, or if the upgrade to formit just fixed the issue. Perhaps my previously outdated version of Formit had a vulnerability that was exploited. Should have checked to see if the problem was gone before upgrading the formit. Oh well, the problem is now gone.

F.Y.I. This was only happening on the front end not in the admin panel.

Thank you all for your help! I have never seen this before and run MODx on over 20 sites. I was sure it was some sort of hack but who knows.