Answered MODX Weblink redirect behaves as..hacked

Hi guys

May I bother you with a security question please:
I am new to MODX and I have inherited a MODX (Modx Revo 2.5.2) website for a school which is hosted in Hostgator server. I have just found out that one of the Weblink resources published on our website, which leads to the login page of our school intranet sometimes behaves strangely. Sometimes when people click on the resource it tries to redirect them to something arbitrary which doesn't look malicious but still it asks them to login. Just to be exact this is what it tries to redirect : http://yata-international.org/wp-content/uploads/2014/03/newsletter_logo.jpg

I can't see anything wrong with the Weblink content field, it's just htts:// url . The Response Code for the Weblink resource is HTTP/1.1 301 Moved Permanently and the Resource Alias is VLE. Could it be that the response code is wrong or that the Resource Alias gets mixed with something else? Or do you suspect malware?
Any speedy advice would be most welcome.

Many thanks

Can you confirm the links independently just navigating to it yourself and not via MODX/Redirect?

Certain that there are no errors?

wouldn't work for example, but I assume that's just a typo here and not there.

Hi there
thank you for your answer. Yes independently it works fine. It only happens through modx. And yes, apologies. it was a typo. The link is https://
If I could run a tracert url_of_intranet command from my modx or even just ping my url from modx I could see if there is any messing up with the DNS. BUt I dont think ican. Can I?

Try it from a different website, it may be that the destination site is detecting referers and redirecting them. No I don't think you can ping from within MODX itself.

You've probably done this already, but if not, try from a different browser and from a different location in case it's your browser or router that's been hijacked.

Hi LK

Thank you for your answer. I used the Track DNS from the cpanel to ping it and it resolves to the right address. So, still no conclusions..

Thank you Bob. (a million thanks for your Modx Guide book too, it's my Bible : )

Yes I have done that. Not all people get it (logging in from different browsers and locations) but most do.
Could it be something wrong with the Settings of the Weblink? For example the Response Code is HTTP/1.1 301 Moved Permanently. Should I use another Response Code?

I'm glad you got it sorted. Thanks for reporting back.