This was brought to my attention by a friend. It looks like ns1.domainmonger.com and ns2.domainmonger.com are doing wildcard A records for all zones, including those that already exist. If you go to their site and try to register a domain, it properly shows if the domain exists or not. I'm trying to figure out what the reasoning is behind this. My friend alo pointed out this CERT alert, but I'm not sure how it relates: http://www.kb.cert.org/vuls/id/109475 Rick ------- ; <<>> DiG 9.2.3rc4 <<>> @ns1.domainmonger.com www.esdfsadfsdftreet.com a ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50340 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.esdfsadfsdftreet.com. IN A ;; ANSWER SECTION: www.esdfsadfsdftreet.com. 1200 IN A 216.52.102.86 ;; AUTHORITY SECTION: com. 1200 IN NS ns1.domainmonger.com. com. 1200 IN NS ns2.domainmonger.com. ;; Query time: 37 msec ;; SERVER: 216.98.150.33#53(ns1.domainmonger.com) ;; WHEN: Tue Oct 14 09:59:24 2003 ;; MSG SIZE rcvd: 107 ----- ; <<>> DiG 9.2.3rc4 <<>> @ns2.domainmonger.com www.legendz.com a ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40110 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.legendz.com. IN A ;; ANSWER SECTION: www.legendz.com. 1200 IN A 216.52.102.86 ;; AUTHORITY SECTION: com. 1200 IN NS ns1.domainmonger.com. com. 1200 IN NS ns2.domainmonger.com. ;; Query time: 91 msec ;; SERVER: 216.122.4.81#53(ns2.domainmonger.com) ;; WHEN: Tue Oct 14 10:01:28 2003 ;; MSG SIZE rcvd: 98