Can anyone shed some light as to what is happening with Register.com?

Mailman List Mirror (Read Only)
1

We are no longer able to resolve A records for sites that they host.
The NOC has not been able to provide any color and the main lines are tied up --they were able to tell me they were having a DNS issue but that was it. Thanks in advance for any info that you can share.

Joe

2

Looks like they are having some serious issues. It doesn't appear that any
of their domains are resolving. Hosted or otherwise.

3

Hmm -- UltraDNS was attacked; I wonder if there's a connection.
http://blogs.zdnet.com/BTL/?p=15601

    --Steve Bellovin, http://www.cs.columbia.edu/~smb

4

None of their Domain Name Servers are responding.

Even their "Find a Domain Name" search at http://www.register.com/ is borked.

5

A few weeks ago, there was tons of dns pounding all over the net.
Today, we see registrars going dark because of dns issues.
Today, people think Conficker will "do" something.
I am puzzled. Maybe it is just 04/01 paranoia?

6

Thought of one more thing...

Wasn't Conficker also configured to try and register a ton of randomly generated domains? Two registrars go dark today?

Ok, put the imagination on hold...

7

Yes, but there is a counter effort that is being quite effective:

http://confickerworkinggroup.org/wiki/

If nothing else, it has brought together an unprecedented cross-industry,
multi-stakeholder effort in addressing these issues.

- - ferg

8

Looks like they are having some serious issues. It doesn't appear
that any of their domains are resolving. Hosted or otherwise.

Hmm -- UltraDNS was attacked; I wonder if there's a connection.
http://blogs.zdnet.com/BTL/?p=15601

           \-\-Steve Bellovin, http://www.cs.columbia.edu/~smb

A few weeks ago, there was tons of dns pounding all over the net.
Today, we see registrars going dark because of dns issues.
Today, people think Conficker will "do" something.
I am puzzled. Maybe it is just 04/01 paranoia?

Thought of one more thing...

Wasn't Conficker also configured to try and register a ton of randomly

s/register/lookup/

it's likely that more domains go through the grist-mill of
domain-tasting each hour than conficker's creators would 'register'
each day.

generated domains? Two registrars go dark today?

I noticed yesterday that Register.com's (some of register's) customer
domain-hosting ips (dnsXXX.Z.register.com) were routing via prolexic's
infrastructure in FLA... Perhaps the plan was to migrate things over
to prolexic, deal with the 'attack' and then service real customer
requests from there?

$ tr dns044.b.register.com.
...
4 0.ge-5-2-0.BR2.IAD8.ALTER.NET (152.63.32.161) 5 ms 5 ms 5 ms
5 64.212.107.157 (64.212.107.157) 7 ms 7 ms 7 ms
6 WBS-Connect-Miami.TenGigabitEthernet2-4.1121.ar1.
(207.138.122.214) 38 ms 37 ms 37 ms
7 blackhole.prolexic.com (209.200.132.34) 38 ms 37 ms 37 ms
8 * * *
9 * * *
10 * * *
11 unknown.prolexic.com (209.200.168.54) 36 ms !A * 37 ms !A

-chris