In this article:
- Why a business homepage may not show the whole picture
- How unrelated content can appear under a company domain
- What to ask your IT or website provider next
What we found
You paid for a business website. You did not sign up to promote online slots.
During a recent external exposure review, an AI-assisted detection step flagged a subdomain serving an unrelated Indonesian-language gambling site.
In plain English: an address associated with the organization was displaying content that had nothing to do with its business.
The question for your company is simple: would you notice if an old address under your domain started serving content you never approved?
The website you check may not be the whole picture
Businesses accumulate web addresses over time: campaign pages, customer portals, recruiting sites, and vendor-hosted tools. Owners may not see these addresses in day-to-day operations, especially when a former agency or IT provider set them up.
Some use subdomains, such as careers.example.com or orders.example.com. These are illustrative examples, not addresses from the assessment.
A trucking company might have an old driver-recruiting page. A manufacturer might have a retired distributor portal. An accounting firm might have moved to a new client service without fully retiring the previous address.
Your main homepage can work perfectly while another part of your online presence deserves urgent attention.
How can unrelated content appear under a business domain?
Possible causes include a compromised website, a hosting configuration error, or an old connection to a third-party service. You do not need to determine the cause before asking someone qualified to investigate.
In a subdomain takeover, a business can leave a DNS record pointing to a retired resource that another party can claim. Visitors then reach that party’s content through the business’s subdomain. Microsoft documents this risk and recommends removing obsolete DNS references as services are retired.
The finding is a reason to investigate – not a complete diagnosis
That does not establish what happened here. The alert identified unexpected content and called for supporting DNS, certificate, and page evidence.
It did not prove a particular entry point, stolen information, or an attacker’s identity. Indonesian-language content also does not establish the attacker’s location.
Why this matters beyond an embarrassing page
For a small business, unexpected content can create avoidable questions from customers and time spent untangling a problem no one realized was still online.
- Customers see your name. Someone following an old link may reasonably associate what they find with your company.
- Search visibility may suffer. Google’s spam policies address hacked content and redirects, and violations can lead to reduced visibility. We are not claiming this organization received a search penalty.
- Ownership gaps remain hidden. A former agency, a current IT provider, and an internal employee may each assume someone else retired the old service.
What should you ask your IT or website provider?
Start with three questions:
- Which public web addresses exist under our domain?
- Who controls the service behind each address?
- What does each address display today?
If an address serves unexpected content
Ask your provider to preserve evidence, investigate, and contain the exposure promptly. Simply replacing the page may not fix the underlying problem.
See what your business is putting online
Securing Your Biz helps small and midsize businesses understand their public exposure and identify what deserves attention, including assets beyond the homepage.
Our free exposure review is a starting point using publicly available information, without requiring access to your internal systems. Findings can help focus the next conversation with your IT provider; deeper investigation or remediation may require separately scoped work.
Start with Securing Your Biz’s free exposure review. An address you stopped using can still represent your business. Find out what it is serving.
Related resources
Need an evidence-backed starting point?
The free Exposure Review shows what is publicly observable. The Business Security Baseline verifies the essential controls protecting the business.