subdomain hijacked?

Matt Disuko gourmetcisco at
Mon Nov 22 11:19:38 CST 2010

I'm surprised by the sequence of events here..

domain "" is registered with

domain "" expires...

gets picked up by the administrators of "" -

;; ANSWER SECTION:      1655    IN      CNAME 1655 IN     A

;; AUTHORITY SECTION:           160201  IN      NS           160201  IN      NS

Redir'd to a advert site, instead of a default "" holding page or...nowhere.

Apparently quickly renewed and "given back" to the original owners.

Who's at play here?  Does DomainsAtCost have a deal with  Or are they the same company?

It all seems fishy to me.  Is this normal practice?

> Date: Mon, 22 Nov 2010 12:05:21 -0500
> From: ken at
> To: nanog at
> Subject: Re: subdomain hijacked?
> On Mon, Nov 22, 2010 at 08:49:48AM -0800, Wil Schultz said:
>   >Appears that it's a CNAME for 
>   >
>   >The expiry day is 11/22/2011, so if I were to guess I would think that the domain expired, sent to an advert page, and was just renewed.
>   >
>   >-wil
> Smartest attack is to put up a page that looks exactly the same as the
> legit site, but with your own cheaper crappier knockoff starwars paraphenalia
> ('duke', 'tewey', 'princess luba') that you sell instead and make the huge
> profits.
> Not to give anyone any ideas that werent obvious like 15 years ago.
> How anyone can tell the internet is legit at a glance is beyond me. Need
> to hookup firefox's security warning to my speakers to get a modicum of
> alert that SSL is busted, to start, nevermind anything more creative.
> That phishers manage to fake sites that look wrong is also beyond me, what's
> so hard about 'save page as'?
> /kc
> -- 
> Ken Chase - ken at - +1 416 897 6284 - Toronto CANADA
> Heavy Computing - Clued bandwidth, colocation and managed linux VPS @151 Front St. W.

More information about the NANOG mailing list