Sounds plausable, reasonable. - ferg -- Chris Keladis <chris at cmc.optus.net.au> wrote: Just a guess, but perhaps with www.google.com returning NXDOMAIN the gethostby* functions tried variations and ended up resolving sites like www.google.com.net which inadvertantly sent people to the spoof site. Seems plausible to me, anyway. Cheers, Chris.