Re: DNS hijack?

2021-11-13 Thread Jim
On Fri, Nov 12, 2021 at 6:38 PM Robert L Mathews wrote: > I didn't see the page, but for what it's worth, this is governed by this > ICANN policy:> https://www.icann.org/resources/pages/errp-2013-02-28-en It is common that registrars repoint nameservers and redirect web traffic when a domain's r

Re: DNS hijack?

2021-11-13 Thread Nick Hilliard
Stephane Bortzmeyer wrote on 13/11/2021 09:25: To my mind, I simply don't understand why some people continue to use Network Solutions, with the track record they have. indeed. one aspect of this is that it's unusually difficult to migrate away compared to other registrars. Only Primary Cont

Re: DNS hijack?

2021-11-13 Thread Stephane Bortzmeyer
On Fri, Nov 12, 2021 at 03:13:57PM -0800, William Herrin wrote a message of 24 lines which said: > To my mind, though, Netsol's server should not be responding with > authoritative answers to random domains that aren't assigned to it. > That it does makes me think it's a good candidate for bla

Re: DNS hijack?

2021-11-12 Thread Robert L Mathews
On 11/12/21 8:33 AM, Jeff Shultz wrote: I still think that this is not the correct way for NetSol to handle this situation, particularly since the pages they put up look like phishbait designed by Austin Powers. I didn't see the page, but for what it's worth, this is governed by this ICANN po

Re: DNS hijack?

2021-11-12 Thread William Herrin
On Fri, Nov 12, 2021 at 3:09 PM Rubens Kuhl wrote: >> DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to >> produce >> the signed zone if validation were required. > > Nope, they could just remove the DS since they are the registrar for that > domain. DNSSEC only protects ag

Re: DNS hijack?

2021-11-12 Thread Rubens Kuhl
> > > > > DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to > produce > the signed zone if validation were required. > > Nope, they could just remove the DS since they are the registrar for that domain. DNSSEC only protects against a DNS provider going rogue, not your own hire

Re: DNS hijack?

2021-11-12 Thread Jim
it points to 64.130.200.16 - > which seems to give correct answers - or to 208.91.197.132 - which > replies even for nonexisting domain names. [..] So yes, then.. A DNS Hijack by NetSol redirecting the hostname on an expired SLD related to one of the individual nameserver hosts to a faulty/non-compl

Re: DNS hijack?

2021-11-12 Thread Jeff Shultz
On Fri, Nov 12, 2021 at 11:30 AM Stephane Bortzmeyer wrote: > On Thu, Nov 11, 2021 at 09:44:04PM +, > Richard wrote > a message of 37 lines which said: > > > The second of these is returning the 208.nnn IPnumber for your > > a-record: > > > >dig @VOYAGER.VISER.NET 2dpnr.org > > > >

Re: DNS hijack?

2021-11-12 Thread Stephane Bortzmeyer
On Thu, Nov 11, 2021 at 09:44:04PM +, Richard wrote a message of 37 lines which said: > The second of these is returning the 208.nnn IPnumber for your > a-record: > >dig @VOYAGER.VISER.NET 2dpnr.org > >2dpnr.org. 300 IN A 208.91.197.132 It depends on where you are (from my resol

Re: DNS hijack?

2021-11-12 Thread Richard
> Date: Thursday, November 11, 2021 13:28:07 -0800 > From: Jeff Shultz > > Okay, so this is anecdotal, but since the domain belongs to me it's > more than a little annoying. > > I got some calls that one of my domains, 2dpnr.org was going to a > page that said it was Network Solutions and that

Re: DNS hijack?

2021-11-12 Thread Jeff Shultz
On Fri, Nov 12, 2021 at 7:07 AM Matthew Petach wrote: > > I suspect it's more a case of > > domain foo.com provides DNS service for several other domains, > including bar.com. > > bar.com is fully paid up. > > foo.com doesn't get paid up on time; expires, but is quickly > re-claimed and paid up a

Re: DNS hijack?

2021-11-12 Thread Matthew Petach
On Fri, Nov 12, 2021 at 5:55 AM William Herrin wrote: > On Thu, Nov 11, 2021 at 6:36 PM Jeff Shultz > wrote: > > > > > > Yeah, apparently when a domain expires, a lot of DNS queries to domains > in that domain's DNS server... get redirected to a Network Solutions "this > is expired" website at t

Re: DNS hijack?

2021-11-12 Thread William Herrin
On Thu, Nov 11, 2021 at 6:36 PM Jeff Shultz wrote: > > > Yeah, apparently when a domain expires, a lot of DNS queries to domains in > that domain's DNS server... get redirected to a Network Solutions "this is > expired" website at that IP. > Even though those domains are perfectly legit and paid

Re: DNS hijack?

2021-11-12 Thread Stephane Bortzmeyer
On Thu, Nov 11, 2021 at 01:36:58PM -0800, Jeff Shultz wrote a message of 122 lines which said: > Never mind, looks like an expired domain issue. Someone didn't remind > someone else. To avoid such a problem: * some registries allow for multi-year registration, * some registrars allow for mul

Re: DNS hijack?

2021-11-11 Thread Jeff Shultz
Yeah, apparently when a domain expires, a lot of DNS queries to domains in that domain's DNS server... get redirected to a Network Solutions "this is expired" website at that IP. Even though those domains are perfectly legit and paid up. Or so it was explained to me and how it appeared. Anything I

Re: DNS hijack?

2021-11-11 Thread Stephane Bortzmeyer
On Thu, Nov 11, 2021 at 01:28:07PM -0800, Jeff Shultz wrote a message of 105 lines which said: > I hit my registrar, DirectNic, and found I'm good through 2023. They > pulled up DNS checker and found that a bunch of DNS servers were > showing 208.91.197.132 as the IP for the domain. It's actua

Re: DNS hijack?

2021-11-11 Thread Jeff Shultz
Never mind, looks like an expired domain issue. Someone didn't remind someone else. On Thu, Nov 11, 2021 at 1:28 PM Jeff Shultz wrote: > Okay, so this is anecdotal, but since the domain belongs to me it's more > than a little annoying. > > I got some calls that one of my domains, 2dpnr.org was g

DNS hijack?

2021-11-11 Thread Jeff Shultz
Okay, so this is anecdotal, but since the domain belongs to me it's more than a little annoying. I got some calls that one of my domains, 2dpnr.org was going to a page that said it was Network Solutions and that my domain was available for renew or purchase. I hit my registrar, DirectNic, and fou