NS just redirected me to spam

Just got this while navigating the forum, i dont remember the exact thread but it was in SG i beleive

1z5rbwi.png
 
It happened to me yesterday but this time there was a voice saying that i really needed to call the number on the page.
 
13408024:.Rybak. said:
It happened to me yesterday but this time there was a voice saying that i really needed to call the number on the page.
Click to expand...

Same thing happened to me right about a minute ago. C'mon NS! I expect more from you!
 
Can confirm this is still happening to me too.

It usually happens when I open newschoolers for the first time in a day/ first time in several hours.
 
13408289:NH_OPERATOR said:
Are these the correct IPs and name servers? DNS hijacking is becoming a more common way to do this kind of thing. Info article on it toohttp://dyn.com/blog/dns-101-explaining-how-hijacks-can-happen/

DiG 9.8.3-P1 newschoolers.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER
Click to expand...

If you were adding more, then I apologize. This is what I stole from your comments earlier.

DNS hijacking is becoming a more common way to do this kind of thing DiG 9.8.3-P1 newschoolers.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER
 
;; global options: +cmd

;; Got answer:

;; ->>HEADER- opcode: QUERY, status: NOERROR, id: 38960

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:

;newschoolers.com. IN A

;; ANSWER SECTION:

newschoolers.com. 86400 IN A 64.93.76.133

;; AUTHORITY SECTION:

newschoolers.com. 86400 IN NS ns15.dnsmadeeasy.com.

newschoolers.com. 86400 IN NS ns13.dnsmadeeasy.com.

newschoolers.com. 86400 IN NS ns12.dnsmadeeasy.com.

newschoolers.com. 86400 IN NS ns14.dnsmadeeasy.com.

newschoolers.com. 86400 IN NS ns10.dnsmadeeasy.com.

newschoolers.com. 86400 IN NS ns11.dnsmadeeasy.com.

;; ADDITIONAL SECTION:

ns10.dnsmadeeasy.com. 77460 IN A 208.94.148.4

ns11.dnsmadeeasy.com. 69731 IN A 208.80.124.4

ns12.dnsmadeeasy.com. 69731 IN A 208.80.126.4

ns13.dnsmadeeasy.com. 69731 IN A 208.80.125.4

ns14.dnsmadeeasy.com. 69731 IN A 208.80.127.4

ns15.dnsmadeeasy.com. 69731 IN A 208.94.149.4
 
Yes, those are the correct DNS servers for Newschoolers.com. (I know the message got cut off but Mr.Bishop forwarded me a copy of what you gave him).

The issue seems to be that users are being redirected from an NS page immediately after it loads. A DNS hijack wouldn't cause this, unless it was redirecting visitors to a proxy server that served our page with injected JS, which I think is unlikely. DNS hijacking would usually result in NS being completely unavailable for users affected by the malicious DNS responses. As far as we know, this isn't what users are experiencing.
 
If they are doing it smartly, they will know they will get more hits long term from leaving the page working 90% of the time and only redirecting occasionally instead of wholesale redirecting all traffic all the time. You cannot use the whois to verify as they are both pulling from the same location. The system admin would know the proper servers though.

Anyway if you've already ruled out a DNS hijack them it would have to be a serverside issue. I can only help troubleshoot DNS =P
 
As far as I know *.dnsmadeeasy.com are the correct DNS servers for our domain. Control over our domain name is actually managed by the technical lead at TEN, so I will make 100% certain with them that this is correct. Thanks for the suggestion.
 
You must log in or register to reply here.
Back
Top