.mn.rr.com dns possibly hacked?
One of my customers, who's got a cable modem off of mn.rr.com is reporting that roughly half the DNS lookups being done on their servers are returning the IP to www.lolitasex.com. I have no idea how widespread this is, but apparently others in minneapolis are seeing the same thing. If any of you have customers asking why their website is now a porn site, this may be why. :) -- Kevin
On Sat, Mar 10, 2001 at 01:28:06PM -0600, Kevin Day wrote:
One of my customers, who's got a cable modem off of mn.rr.com is reporting that roughly half the DNS lookups being done on their servers are returning the IP to www.lolitasex.com. I have no idea how widespread this is, but apparently others in minneapolis are seeing the same thing.
Is he running his on caching nameserver, or roadrunners? I expect someone needs to upgrade their nameserver. -- John Payne http://www.sackheads.org/jpayne/ john@sackheads.org http://www.sackheads.org/uce/ Fax: +44 870 0547954 To send me mail, use the address in the From: header
I use my Minneapolis (actually St Paul) RR Cable modem every day, all day long for vpn access as well as personal use. Haven't seen a single problem with dns resolution using mn.rr.com. I suppose it is possible that mpls and st paul use different servers. I believe their primary is my secondary. -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of John Payne Sent: Saturday, March 10, 2001 2:55 PM To: Kevin Day Cc: nanog@merit.edu Subject: Re: .mn.rr.com dns possibly hacked? On Sat, Mar 10, 2001 at 01:28:06PM -0600, Kevin Day wrote:
One of my customers, who's got a cable modem off of mn.rr.com is reporting that roughly half the DNS lookups being done on their servers are
returning
the IP to www.lolitasex.com. I have no idea how widespread this is, but apparently others in minneapolis are seeing the same thing.
Is he running his on caching nameserver, or roadrunners? I expect someone needs to upgrade their nameserver. -- John Payne http://www.sackheads.org/jpayne/ john@sackheads.org http://www.sackheads.org/uce/ Fax: +44 870 0547954 To send me mail, use the address in the From: header
Sorry, didn't realize this was an old thread -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of John Payne Sent: Saturday, March 10, 2001 2:55 PM To: Kevin Day Cc: nanog@merit.edu Subject: Re: .mn.rr.com dns possibly hacked? On Sat, Mar 10, 2001 at 01:28:06PM -0600, Kevin Day wrote:
One of my customers, who's got a cable modem off of mn.rr.com is reporting that roughly half the DNS lookups being done on their servers are
returning
the IP to www.lolitasex.com. I have no idea how widespread this is, but apparently others in minneapolis are seeing the same thing.
Is he running his on caching nameserver, or roadrunners? I expect someone needs to upgrade their nameserver. -- John Payne http://www.sackheads.org/jpayne/ john@sackheads.org http://www.sackheads.org/uce/ Fax: +44 870 0547954 To send me mail, use the address in the From: header
Hello, maybe an spoofing Attack..... cu (C)arlos On Sat, Mar 10, 2001 at 01:28:06PM -0600, Kevin Day wrote:
Delivered-To: carlosh@de.colt.net Delivered-To: nanog-outgoing@merit.edu From: Kevin Day <toasty@temphost.dragondata.com> Subject: .mn.rr.com dns possibly hacked? To: nanog@merit.edu Date: Sat, 10 Mar 2001 13:28:06 -0600 (CST) X-Mailer: ELM [version 2.5 PL3] Precedence: bulk Errors-To: owner-nanog-outgoing@merit.edu X-Loop: nanog
One of my customers, who's got a cable modem off of mn.rr.com is reporting that roughly half the DNS lookups being done on their servers are returning the IP to www.lolitasex.com. I have no idea how widespread this is, but apparently others in minneapolis are seeing the same thing.
If any of you have customers asking why their website is now a porn site, this may be why. :)
-- Kevin
-- ___ ___ ___ ___ \C/ \O/ \L/ \T/ (C)arlos Heller (carlosh@de.colt.net) - COLT TELECOM GmbH V V V V Fon +49 69 95958 0 - Fax +49 69 959598 6350
participants (4)
-
Carlos Heller -
John Payne -
Kevin Day -
Michelle T