From owner-freebsd-security@FreeBSD.ORG  Fri Dec 30 22:28:30 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7D0F016A41F;
	Fri, 30 Dec 2005 22:28:30 +0000 (GMT)
	(envelope-from scheidell@secnap.net)
Received: from secnap2.secnap.com (secnap2.secnap.com [204.89.241.128])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 12C2F43D58;
	Fri, 30 Dec 2005 22:28:29 +0000 (GMT)
	(envelope-from scheidell@secnap.net)
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0
Date: Fri, 30 Dec 2005 17:28:28 -0500
Message-ID: <B3BCAF4246A8A84983A80DAB50FE724255BD66@secnap2.secnap.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Domtools.com hyjacked?
Thread-Index: AcYIwInJ1VZxJvAFTXmIhb9E0QqLEQEzox+w
From: "Michael Scheidell" <scheidell@secnap.net>
To: <ports@freebsd.org>,
	<pbalyoz@jammed.com>
Cc: freebsd-security <freebsd-security@freebsd.org>
Subject: Domtools.com hyjacked?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Dec 2005 22:28:30 -0000

Attempted to install dlint port.

Only distribution site is www.domtools.com

Email to 'content@domtools.com' and pab@domtools.com bounces (can't
relay)
Phone number missing on whois record.

Fetch of tarball fails checksum (it delivers a generic 'web hosted
search engine that just hijacked someone's domain' web page.

Maybe domtools didn't renew?  New web company messed up dns or apache
virtual hosting records?

Don't know where else to find a safe copy of dlint