4

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ago, never used it till now. It was parked at the registrar (register.com) We did a setup to point to the hosting servers, then created the appropriate subdomain pointers, etc...

So we're waiting for things to propogate. I thought I'd check the site, first via browser, no go. It still shows the site is parked, at register.com. Thought I'd ping the site with a command line interpreter (in this case I'm using Linux) and see what happens.

Way odd. The site pings to an IP address I've never heard of before. It pings to 208.91.197.39: Hmmm wonder where that came from. I plugged that IP address directly into the browser, and immediately got routed to on of those Beware you have a virus, call XXX to get out of jail sites. Ugh.

I look up that IP address on gwhois.org and its registered to "Confluence Networks Inc, Road Town, Tortola, VG" We have no clue how this occurred.

I'm assuming there is a script out there running that looks for any URL without designated IP location and re-assigns itself instead. Is this even possible?

Anybody know what is going on? Should we be worried?

  • 7
    This is a DNS hijack - contact your registrar. – schroeder Jul 2 '15 at 4:54
2

As @schroeder said, someone (probably the same ones that control the 208.91.197.39 IP) hijacked the DNS of your registrar. This means that they changed the DNS records so that the domain (what you incorrectly call "URL") name your customer bought now points to the IP 208.91.197.39 instead to the legitimate IP or domain assigned to your customer.

The reason why they do that are many: for instance to generate traffic for a web site hosting ads/scams/malware, or to impersonate another domain to do frauds.

1

TL;DR it could be the router that has been infected.

My reasoning is as follows. The OP said,

  1. I thought I'd check the site, first via browser, no go. It still shows the site is parked, at register.com.
  2. Thought I'd ping the site with a command line interpreter (in this case I'm using Linux) and see what happens. Way odd. The site pings to an IP address I've never heard of before. It pings to 208.91.197.39
  3. I plugged that IP address directly into the browser, and immediately got routed to on of those Beware you have a virus, call XXX to get out of jail sites.

If this was a DNS hijack he should have gotten the same IP address in the browser and in the CLI. And we know that the IP works as a Web host, so it should have worked like #3 both in case #1 and in case #2.

My hypothesis is that the browser and the Linux command line are on two different machines, with different DNSs.

Since one of the two DNSs appears to return a result which seems correct (also, nothing was said about browsers malfunctions, which should be noticed way quicker than PING malfunctions), I'm inclined to believe that the browser had it right and, therefore, one DNS was correctly configured.

Where did the second DNS answer (the malwared one) come from? I'd be wary of the router. There are several worms that try and break into unsecured routers and replace the DNS server with a rogue one that supplies infected addresses to its clients.

What I see happening, though, in several small installations, is that quite often the "owner" of a workstation will twiddle with the IP settings, for example moving from DHCP to static IP address and placing "faster" DNS entries (nine cases out of ten, Google's 8.8.8.8) in the resolver setting. Absent a proactive IT administrator and strict policies in place (most small firms haven't one), the network quickly stabilizes on a hodgepodge of slowly varying IP addresses (not DHCP, not exactly static; more of a "static-until-conflict-kills-surfing" - pity the acronym for that is already taken). Some machines, usually the stabler ones, use the router's DHCP, the others slowly gravitate towards the ISP's, or Google's.

And so it happens: the Windows machine with the browser resolves the dead IP and does nothing. The Linux machine trusts the router's DNS resolver and gets handed a malware address.

Sometimes, the problem is "solved" by changing the DNS address on the machine, and no one notices that the router is still infected, but worse than that, it is still vulnerable. Today it was DNS redirection -- tomorrow a more intrusive worm can establish a tunnel and scan the intranet machines, siphoning disk shares in search of valuable information, and if nothing else, hogging the whole bandwidth while doing so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.