Date: Tue, 24 Mar 2009 16:49:53 +0900 From: "UEDA Hiroyuki" <ueda@netforest.ad.jp> To: freebsd-security@freebsd.org Subject: Re: DNS of FreeBSD.org been Attacked!? Message-ID: <20090324164644.A697.5F3C430A@netforest.ad.jp> In-Reply-To: <a951c2910903232356y4faa9fd6nb3ebfd2215ca4d39@mail.gmail.com> References: <a951c2910903232356y4faa9fd6nb3ebfd2215ca4d39@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello,
> C:\Documents and Settings\Administrator>nslookup ftp11.tw.freebsd.org 168.95.1.1
>
> Server: dns.hinet.net
> Address: 168.95.1.1
>
> Name: ftp11.tw.freebsd.org.com.tw
^^^^^^^^
You seem to nslookup "ftp11.tw.freebsd.org.COM.TW". If it's right,
> Address: 82.98.86.170
is correct as follows:
$ dig A ftp11.tw.freebsd.org.com.tw
; <<>> DiG 9.2.4 <<>> A ftp11.tw.freebsd.org.com.tw
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53400
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;ftp11.tw.freebsd.org.com.tw. IN A
;; ANSWER SECTION:
ftp11.tw.freebsd.org.com.tw. 600 IN A 82.98.86.170
So you had better check your PC's settings.
BTW, a wild card record(*.org.com.tw) is probably used. For example, I
got same results with following queries:
$ dig A foo.bar.freebsd.org.com.tw
$ dig A foo.bar.org.com.tw
$ dig A foo.org.com.tw
Best regards.
-----
UEDA Hiroyuki <ueda@netforest.ad.jp>
Netforest Inc., JAPAN
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090324164644.A697.5F3C430A>