Google DNS Domain Hijack?
Insight
sometimes my browser ends up pointing me to (do not click link)
http://file2store.info/download.php?id=1D10F94A which then fires my
anti virus saying there is a virus.
Other times I visit then take me to the correct site as normal.
I have tried on other machines not using Google DNS and this doesn't
happen. Is this a google DNS issue?
Diagnostics:
Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\>nslookup -debug canon-fodder-forums.com 8.8.8.8
------------
Got answer:
HEADER:
opcode = QUERY, id = 1, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0,
additional = 0
QUESTIONS:
8.8.8.8.in-addr.arpa, type = PTR, class = IN
ANSWERS:
-> 8.8.8.8.in-addr.arpa
name = google-public-dns-a.google.com
ttl = 40853 (11 hours 20 mins 53 secs)
------------
Server: google-public-dns-a.google.com
Address: 8.8.8.8
------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NXDOMAIN
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1,
additional = 0
QUESTIONS:
canon-fodder-forums.com.config, type = A, class = IN
AUTHORITY RECORDS:
-> (root)
ttl = 86400 (1 day)
primary name server = A.ROOT-SERVERS.NET
responsible mail addr = NSTLD.VERISIGN-GRS.COM
serial = 2010022401
refresh = 1800 (30 mins)
retry = 900 (15 mins)
expire = 604800 (7 days)
default TTL = 86400 (1 day)
------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 3, rcode = NXDOMAIN
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1,
additional = 0
QUESTIONS:
canon-fodder-forums.com.config, type = AAAA, class = IN
AUTHORITY RECORDS:
-> (root)
ttl = 86400 (1 day)
primary name server = A.ROOT-SERVERS.NET
responsible mail addr = NSTLD.VERISIGN-GRS.COM
serial = 2010022401
refresh = 1800 (30 mins)
retry = 900 (15 mins)
expire = 604800 (7 days)
default TTL = 86400 (1 day)
------------
------------
Got answer:
HEADER:
opcode = QUERY, id = 4, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 0,
additional = 0
QUESTIONS:
canon-fodder-forums.com, type = A, class = IN
ANSWERS:
-> canon-fodder-forums.com
internet address = 91.207.221.71
ttl = 2608 (43 mins 28 secs)
------------
Non-authoritative answer:
------------
Got answer:
HEADER:
opcode = QUERY, id = 5, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1,
additional = 0
QUESTIONS:
canon-fodder-forums.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> canon-fodder-forums.com
ttl = 3600 (1 hour)
primary name server = ns1.globalgold.co.uk
responsible mail addr = hostmaster.globalgold.co.uk
serial = 2009120410
refresh = 10800 (3 hours)
retry = 3600 (1 hour)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
------------
Name: canon-fodder-forums.com
Address: 91.207.221.71
This appears to have resolved correctly (the redirect appears to only
happen the first or second times I try and visit the page.
I have also scanned my machine with just about everything and can't
find any nasty software that might be doing this.
I am going to remove Google DNS from one of my machines and see if the
issue stops, I will update this thread with my findings.
Alex Smith
--
========================================================
You received this message because you are subscribed to the Google
Groups "public-dns-discuss" group.
To post to this group, send email to public-dn...@googlegroups.com
To unsubscribe from this group, send email to
public-dns-disc...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/public-dns-discuss?hl=en
For more information on Google Public DNS, please visit
http://code.google.com/speed/public-dns
========================================================
Wilmer van der Gaast
> C:\>nslookup -debug canon-fodder-forums.com 8.8.8.8
> ------------
> Got answer:
> HEADER:
> ------------
> Got answer:
> HEADER:
> opcode = QUERY, id = 2, rcode = NXDOMAIN
> header flags: response, want recursion, recursion avail.
> questions = 1, answers = 0, authority records = 1,
> additional = 0
>
> QUESTIONS:
> canon-fodder-forums.com.config, type = A, class = IN
Note also how your question somehow got mangled here: Where does the
.config part come from?
Cheers,
--
Wilmer van der Gaast, Dublin Traffic SRE.
Google Ireland.
Insight
testing all day (having removed Google's DNS servers) I can't
replicate it any more :/
I wondered what the .config bit was as well.
Anyone have any insight into this?
On Feb 25, 12:03 pm, Wilmer van der Gaast <wil...@google.com> wrote:
Brandon Rusnak
Search. I got redirected when trying to view another forum, not the
one mentioned by the OP.
The file2store.info site is suspicious in that it was only registered
three weeks ago and already has a good Alexa traffic rank, something
like 75,000th. It also has no backlinks last time I checked.
To the OP, when you got redirected to the site, were you prompted to
download a file or did you get the "This file has been removed"
message? Please go into as much details as possible. I'm trying to
see if this is a DNS problem as you mentioned or if it is a result of
either client-side malware or malware on a compromised site
redirecting visitors to this site.
Brandon Rusnak
appears that all the sites that are having their users redirected to
file2store DOT info are running vBulletin version 3.8.4 or older, so
it appears this may be a vBulletin exploit of some type.
The site the OP mentioned appears to be upgrading their vBulletin
right now to a 4.X release, perhaps due to this issue.
Any more information anyone has would be appreciated.
Thanks
Chad Embrey
http://forum.vbulletinsetup.com/f7/attn-all-vbulletin-webmasters-you-may-34659.html#post101934