Pinging website returns 127.0.0.1

Question

I have a website that cannot be loaded when browsing, so I pinged that website, it shows a reply from 127.0.0.1 (In a normal situation it will show our local IP address or proxy)

I checked the hosts file but did't show any different inside, just the default hosts file:

So, how can I fix my website? Because it's returning 127.0.0.1, I cannot load the website.

Solution 1

Sometimes when sites get attacked they change the DNS entry for the site to 127.0.0.1 which is the localhost address. That makes it so the attackers send the attacks back to themselves. Until they change the DNS entry back to the correct IP you need to wait. This does not mean they think you attacked them.

Solution 2

Try to use another *nix machine and and see if it gets the same answer. For example run:

dig <site_address>

and see in the answer to what IP resolves.

For this I will give you an example of thepiratebay.com that returns 127.0.0.1 (on Sept 29, 2016)

As you can see 127.0.0.1 is the answer (see note 1.)

This command queries the against the local DNS so you might want to try to directly query the authoritative name servers (like the one in note 2.) for the a more detailed answer.

For this you must take the name server address and query against that like:

dig @ns1.eurodns.com <site_address>

In case the remote box is a Windows machine you can make dig available (see Using the dig dns tool on Windows 7

Comments

[CodeCaster]

Who manages this network? Does this happen on all devices in the network? Can you do a nslookup to find which server returns that IP for that name? Can you change your DNS to 8.8.8.8 and try again?

[Francisco Tapia]

open cmd, write hostname and press enter, tell us if the returned value is the same than the website.

[chankin]

Any proxy and internet option had been reset many times already. I also got try google dns but result still same . I had tried the nslookup ,it show i.imgur.com/5j7o17v.png

[CodeCaster]

This would be a nice answer if it were the case. Let OP fill in the gaps first, there are many possible causes. For all we know, their systems administrator added the entry to their DNS because OP was on reddit all day.

[chankin]

I dont think so because same internet connection , I used another laptop of my friend still can browse the website, and any proxy and internet option had been reset many times already.

[Christian Isaksson]

If another computer on the same connection (ie, using same dns/gateway) can access the site then either the issue was fixed and your comp is using old dns data still (close all browser windows and run ipconfig /flushdns, then retry) or some sort of software (malware?) on the computer is trying to route the connection via another site that's currently pointing to 127.0.0.1. They sometimes do that to either track users activity or display evil adds.

[chankin]

ipconfig /flushdns had run but still same I have used malwarebytes and adwcleaner clean but no any malware Maybe some setting had been change or anyelse but I dont want format my PC anymore because too much times PC was format and dont want risk my harddisk anymore My friend just give me a solution was create a local proxy for me ,used it when certain website cannot be loaded