<div dir="ltr"><div>Wow, news to me, and it's worse than you thought. They're spoofing responses for ALL non-existent domains, not just those starting with a "w":</div><div></div><div><br> langsam:~# whois <a href="http://unregistereddomaintest.com">unregistereddomaintest.com</a> | head -1<br>No match for "<a href="http://UNREGISTEREDDOMAINTEST.COM">UNREGISTEREDDOMAINTEST.COM</a>".</div><div><br></div><div>langsam:~# dig +short a <a href="http://unregistereddomaintest.com">unregistereddomaintest.com</a> @<a href="http://4.2.2.2">4.2.2.2</a><br>23.202.231.167<br>23.217.138.108<br></div><div><br></div><div>langsam:~# dig +short a <a href="http://unregistereddomaintest.mil">unregistereddomaintest.mil</a> @<a href="http://4.2.2.2">4.2.2.2</a><br>23.202.231.167<br>23.217.138.108</div><div><br></div><div>I can't get an NXDOMAIN result from 4.2.2.2 at all.</div><div><br></div><div>Good to know. Time to reconfigure 10,000 firewalls.</div><div><br></div><div>Thank you Lawrence.</div><div><br></div><div>- Cary Wiedemann<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 19, 2019 at 10:35 AM Marshall, Quincy <<a href="mailto:Quincy.Marshall@reged.com">Quincy.Marshall@reged.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-5185573219912372978WordSection1">
<p class="MsoNormal">This is mostly informational and may have already hit this group. My google-foo failed me if so.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I discovered that the CenturyLink/Level(3) public DNS (4.2.2.2, etc) are spoofing all domains. If the hostname begins with a “w” and does not exist in the authoritative zone these hosts will return two Akamai hosts.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.gov" target="_blank">w3.dummydomaindoesntexist.gov</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.net" target="_blank">w3.dummydomaindoesntexist.net</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.com" target="_blank">w3.dummydomaindoesntexist.com</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.org" target="_blank">w3.dummydomaindoesntexist.org</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My apologies if this is old news.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri Light",sans-serif;color:rgb(95,73,122)">Lawrence Q. Marshall</span></b><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<br><br><span style="font-family:Arial;font-size:10pt"> <hr width="100%"> This email has been scanned for email related threats and delivered safely by Mimecast.<br> For more information please visit <a href="http://www.mimecast.com" target="_blank">http://www.mimecast.com</a> <hr width="100%"> </span></div>
</blockquote></div>