0

Below are the DNS servers that I have been using for many years:

84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net  ISP: Accelerated IT Services GmbH)
91.239.100.100 Uncensored DNS (IP: 130.225.244.166  Hostname: deic-lgb.anycast.censurfridns.dk  ISP: Danmarks Tekniske Universitet)
85.214.20.141 Foebud (Hostname: h1768020.stratoserver.net  ISP: Strato AG)
82.141.39.32 OpenNIC (DE) (Hostname: quaternary.server.edv-froehlich.de  ISP: KAMP Netzwerkdienste GmbH)
82.196.9.45  OpenNIC (NL) (Hostname: none ISP: Digital Ocean)

I used to be able to access the website pressreader.com in the past until recently. About a month ago, if I typed www.pressreader.com directly into my browser, the website would be inaccessible. (Note: I have no problem accessing other websites at all.)

I now use one of the workarounds below:

Method #1

a. launch a search engine like Google or DuckDuckGo
b. type "pressreader climate change" (without quotes) or any phrase that includes pressreader as one of the words
c. from the list of the results of the search, click on any result that has the word Pressreader

Method #2

Use a VPN (free or paid service) to access Pressreader

Method #3

Change my existing DNS servers to either Google's, OpenDNS' or those provided by my ISP

8.8.8.8 Google
8.8.4.4 Google

208.67.222.222 OpenDNS
208.67.220.220 OpenDNS

Additional info:

I only read news on pressreader.com at home. My home computer is connected to the modem (provided by my ISP).

Am I right to believe that the DNS servers that I have been using all this while have been poisoned?

Per Moonsik Park's suggestion

I typed nslookup -query=any pressreader.com in a terminal/console and below are the results:

username@hostname:~$ nslookup -query=any pressreader.com
;; Truncated, retrying in TCP mode.

Non-authoritative answer:
Name:   pressreader.com
Address: 107.154.111.111
Name:   pressreader.com
Address: 107.154.103.111
pressreader.com nameserver = ns2.newspaperdirect.com.
pressreader.com nameserver = ns3.newspaperdirect.com.
pressreader.com
    origin = ns2.newspaperdirect.com
    mail addr = hostmaster1.newspaperdirect.com
    serial = 1018
    refresh = 900
    retry = 600
    expire = 86400
    minimum = 3600
pressreader.com mail exchanger = 20 ndmail.newspaperdirect.com.
pressreader.com mail exchanger = 10 adab.pressreader.com.
pressreader.com text = "ZA=4CgDvbUCl3GAgI0vDd2dKw=="
pressreader.com text = "globalsign-domain-verification=EDgZxi7787wPfMQiYBv6Ozzb_TN1aizyNzGX4ivO98"
pressreader.com text = "_globalsign-domain-verification=wFqJgfjXebcCp5uT9zGMgShVZ2CoKeUUW-oyud5cO1"
pressreader.com text = "globalsign-domain-verification=3c-6TB-cG8LBvkfkOGKMCjIEzTjuPaL-U1mJ_PjnNe"
pressreader.com text = "MS=A8AD5E10FE533C17EDA5293095360D727A967AAA"
pressreader.com text = "cloudflare-verify 189356383-34794676"
pressreader.com text = "v=spf1 mx ip4:204.50.102.44 ip4:204.50.102.26 ip4:204.50.102.50 ip4:204.50.102.246 ip4:208.181.59.34 ip4:208.181.59.36 ip4:208.181.59.39 ip4:208.181.59.253 include:sendgrid.net include:mail.zendesk.com include:servers.mcsv.net -all"
pressreader.com text = "MS=ms36475603"
pressreader.com text = "globalsign-domain-verification=AtQ1zLCdH6JdJ_bs3f2aP9sBShOfzhFCCTJ8tfwk9j"

Authoritative answers can be found from:
adab.pressreader.com    internet address = 207.34.140.7

Next, I accessed www.centralops.net/co and typed pressreader.com. The results provided the same details as those obtained by performing a local nslookup query.

Finally I typed 107.154.111.111 into my browser and clicked Go. Below is the response:

107.154.111.111 - Resolving failed

Error code 22

The proxy failed to resolve site from host name, if this site was recently added please allow a few minutes before trying again.
|improve this question
  • 1
    Note pressreader.com (which you used for nslookup) and www.pressreader.com are different hosts, with different addresses, although the former redirects (301) to the latter; and both/all of them are apparently run by Incapsula, as linked at the bottom of the page which you apparently ignored; Incapsula is a frontend/proxy that handles many sites from the same address(es) and thus must be accessed by name not address in order to know which site to serve to you (although the error message could be friendlier). ... – dave_thompson_085 Nov 15 '18 at 4:19
  • 1
    ... Clicking a google or DDG link (eventually) uses your DNS the same as direct entry, so if they work your DNS is okay and something else is wrong. Since one of Incapsula's purposes is to defend against attacks, it may be that your direct access attempts are somehow resembling or being (mis)recognized as an attack. – dave_thompson_085 Nov 15 '18 at 4:23
  • @dave_thompson_085 Thanks for the detailed explanation. I didn't know about this frontend/proxy thing. Is Incapsula even legal to be acting on behalf of many distinct websites sharing the same IP addresses? – ssdhddinfected Nov 15 '18 at 13:28
  • @dave_thompson_085 For many years I had been able to access Pressreader by simply typing pressreader.com into my browser. Incapsula could have reconfigured its settings to reject certain DNS servers. As stated in my original post, DNS servers from Google, OpenDNS and even my ISP are able to resolve pressreader.com without a problem. – ssdhddinfected Nov 15 '18 at 13:34
  • @dave_thompson_085 You wrote: Clicking a google or DDG link (eventually) uses your DNS the same as direct entry, so if they work your DNS is okay I'm not quite sure I understood what you had written. Are you saying that whenever I click on a Google or DDG link, my DNS servers are resolving the links and not Google's or DDG's DNS servers? I learnt something new from you today. Thanks. – ssdhddinfected Nov 15 '18 at 13:38
2

DNS Poisoning happens when DNS queries are modified by attacker's needs.

To check whether your DNS queries are poisoned, you can check with the following steps.

  1. Run nslookup <target site>
  2. Google online nslookup and do an online nslookup.

If your local nslookup does not match with various online nslookup results, it is highly likely that your DNS queries are monitored and modified on the fly.

If your government or ISP is monitoring the DNS, it is likely that you can't benefit from using 8.8.8.8 or 1.1.1.1 because DNS queries are not encrypted and it can be directly modified from the ISP before even reaching the target DNS server.

To mitigate this, you can encrypt DNS queries using DNS Over TLS/HTTPS or use Tor or VPN. Note that if you don't set up your VPN correctly you might leak your DNS queries.

|improve this answer
  • Thanks for your reply. What is the most popular service to encrypt DNS queries? Is it DNScrypt? – ssdhddinfected Nov 14 '18 at 5:27
  • Per your suggestion, I performed a local nslookup query and an online one. The results are in the original post. – ssdhddinfected Nov 14 '18 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.