Skip to main content
253 votes
Accepted

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F. $ echo ...
Miles's user avatar
  • 866
125 votes
Accepted

Did I just get DNS Hijacked?

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got ...
Arminius's user avatar
  • 45.1k
73 votes

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

Content Delivery Network This is probably part of a Content Delivery Network with a lot of political issues to consider. If you try dig www.whitehouse.gov a, underneath the answer section you'll ...
Mark Buffalo's user avatar
  • 22.6k
69 votes
Accepted

More than three domains hosted on the same IP address

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of ...
Conor Mancone's user avatar
56 votes
Accepted

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
Shackledtodesk's user avatar
52 votes
Accepted

Domain about to expire. Afraid that new owners will spread malware

Unless your freeware is somewhat popular or used by high-value targets, its usefulness for conducting supply chain attacks is probably limited. If the domain name enjoys good SEO, I would rather ...
Kate's user avatar
  • 8,465
50 votes

Is LetsEncrypt activity Public?

New certificates end up in certificate transparency logs which are visible to the public. This can be used to detect seemingly hidden domains, which are not linked from somewhere, might not be even ...
Steffen Ullrich's user avatar
49 votes

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
paj28's user avatar
  • 34.7k
49 votes
Accepted

Is it possible for a name server provider to hijack MX records?

Yes, your registrar can hijack not only your MX records, but your entire DNS. Not only that - but they can then proceed to intercept mail sent to your domain, get a valid CA-signed SSL certificate ...
mti2935's user avatar
  • 24k
48 votes

How could a public DNS server return bad results?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
Steffen Ullrich's user avatar
35 votes

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

Well, I've installed Wireshark and applied a DNS filter to see what was happening. When I do the nslookup from Windows to whitehouse.gov I can see in Wireshark that it is appending (without showing it ...
Alex's user avatar
  • 751
35 votes
Accepted

Why don't browsers check CAA records to help ensure a certificate is valid?

I just found the answer in RFC 6844, DNS Certification Authority Authorization (CAA) Resource Record: A set of CAA records describes only current grants of authority to issue certificates for the ...
James Westman's user avatar
34 votes

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

Update: The explanation given by NextDNS support is wrong, see this answer by Miles instead. I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet ...
Etheryte's user avatar
  • 862
32 votes

More than three domains hosted on the same IP address

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
manassehkatz-Moving 2 Codidact's user avatar
32 votes

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

Again, it's all about the threat model! Technologies are just technologies and can be used both for good and for evil. DNS over HTTPS (DoH) intends to solve the privacy concerns there are with ...
Esa Jokinen's user avatar
  • 19.4k
31 votes

Does DNS allow third parties to register subdomains?

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
reirab's user avatar
  • 2,701
29 votes
Accepted

Does DNS allow third parties to register subdomains?

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
29 votes
Accepted

Is a global DNS record a security risk for phpMyAdmin?

This would qualify as 'Security through Obscurity' and offers little to no protection whatsoever. The /etc/hosts file is NOT DNS; it's the precursor of DNS and anyone can change their own records in ...
LvB's user avatar
  • 9,063
22 votes
Accepted

What does my ISP see if I change my DNS server?

So, I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to ISP DNS and my provider gets response (ip of google.com) and goes by this IP and ...
Steffen Ullrich's user avatar
21 votes

Did I just get DNS Hijacked?

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable ...
Mirsad's user avatar
  • 10.2k
21 votes

How could a public DNS server return bad results?

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from ...
JdeBP's user avatar
  • 701
20 votes

How do I run proper HTTPS on an Internal Network?

"Use public certs, but for internal addresses." This option works quite well, that's what we do. You can actually do HTTP validation, the certificate does not include the IP address, just ...
Bryan Larsen's user avatar
20 votes

Should OS information be in DNS?

The naming conventions of computers has long been a divisive topic and often the security of a network needs to be put up against the manageability of an environment. I have worked in environments ...
DKNUCKLES's user avatar
  • 9,227
20 votes

Domain about to expire. Afraid that new owners will spread malware

Cost makes a big difference. Some people think keeping a domain means spending hundreds of dollars a year because "that's what we've always paid", but that really is not the case. If the ...
manassehkatz-Moving 2 Codidact's user avatar
19 votes

Does DNS allow third parties to register subdomains?

The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are ...
Steffen Ullrich's user avatar
18 votes
Accepted

How can I look up a Certificate Authorities CAA record value?

The best way I can think of is asking the CAA record of issuers' domain. Most likely they have it setup for their own domains. I tried it with a few and it seems to work for some. $ dig caa comodo.com ...
Daniel Szpisjak's user avatar
18 votes
Accepted

Hijacking stale DNS entry to point to your own website

This is a subdomain takeover. They typically happen in one of 2 ways: You have an A record pointing to an IP address that no longer exists and an attacker can gain control of the IP address in ...
Conor Mancone's user avatar
16 votes
Accepted

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
Lekensteyn's user avatar
  • 6,098
16 votes
Accepted

What happens if a DNS record points to non-controlled IP address?

what will be displayed in his browser? Either an error message or the Twitter homepage. Your browser will connect to Twitter's web server, and request the page for foo.com. The webserver can either ...
Sjoerd's user avatar
  • 34.4k
15 votes
Accepted

What's the difference between A and AAAA DNS records?

In DNS, we can have multiple answers and we called them Resource Records, shorten as RR. Among the RR, there are A, AAAA, MX, NS,TXT,DS and many others. More details are available on this wiki page. ...
Gaurav Kansal's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible