Webmidwife --

It's hard to know just exactly what happened; however, I do know that if the URL was yours, there is only one place that the browser can attempt to go -- to the URL listed. Without going deep-tech, it's "how the net works." The following is the public record about the domain, "WEBMIDWIFE.COM." I "assume" that this is YOUR information. Since the registration is mid-cycle for the year, there is no recent renewal or potential lapse in renewal; therefore, it's unlikely that someone else bought your domain while it was lapsed. There IS a webmidwife.org registered; however, it's dormant and has an "under construction" type of page -- perhaps, your BIL failed to type the *.com and the browser autofound the *.org?

RTSDNS.NET = the server where the website is located, OR where the hosting is taking place. There CAN be a repoint from that server to somewhere else, which would keep YOUR URL in the browser and would go elsewhere. But, you would have to specially request this particular action with your WH company, either through a tech support phonecall or through an action in your control center with the WH company.

There is a process called hijacking and this link will take you (or your BIL) to a site that gives a good explanation of this particular type of malware (have to scroll down a bit). But, it will show the URL to the site that you've been hijacked to.

Hope this clarifies things a mite.

__________________
LdyGuique