Unknown URL shows my website

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer.

What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple mistake, or it could be that they were in possession of that IP address before you were, given that their domain name is slightly older than yours.

This is why the site at that domain looks exactly like yours (it is yours!) and you get the invalid certificate error over https (because the certificate is also yours, and so isn't for canadaehtees.com, but for fastslots.co.)

What can you do about? Well, redirecting as you've currently configured is one option. I would suggest that you change the redirect from a 302 (temporary) to a 301 (permanent) if this is the solution you want to use long term.

Other status codes you could return for unknown hosts would be 404 (not found) or 410 (gone).

The more drastic solution, but the one that should permanently fix the issue without any further work on your part would be move your site to another IP.


This looks a lot like a cross-site request forgery website, trying to lure visitors in executing requests to your site without them knowing they are actually sending requests to your domain.

Imagine for example that 'https://canadaehtees.com' has a button on his site 'place free bet'. In case a visitor clicks that button (or automatically triggers the click event unknowingly through javascript), a request is made to your site where a large bet is placed in the visitor's name (because the authentication cookie is sent along, fastslots.co thinks the user is authenticated and accepts the bet).

More information: OWASP CSRF

To protect yourself, you can either block all requests coming from 'https://canadaehtees.com', or implement another CSRF protection such as the synchronizer token pattern. Please consult the OWASP prevention cheat sheet for more information regarding that.