(Credit for spotting this goes to Dima Volodin from Sprint.)
Please check your nameservers for .com NS bogus data. I
had a look around after Dima pointed out the bogus data
in ns.EU.net, and over 3/4 of the nameservers I checked
were infected (sprint, merit, mci, ans, net99, janet ...).
;; ANSWERS:
com. 467325 NS E.ROOT-SERVERS.NET.
com. 467325 NS I.ROOT-SERVERS.NET.
com. 467325 NS F.ROOT-SERVERS.NET.
com. 467325 NS G.ROOT-SERVERS.NET.
com. 467325 NS A.ROOT-SERVERS.NET.
com. 467325 NS H.ROOT-SERVERS.NET.
com. 77377 NS ari.ari.NET.
com. 77377 NS ns2.sprintlink.NET.
com. 77377 NS ns1.sprintlink.NET.
com. 77377 NS ns.peach.NET.
com. 467325 NS B.ROOT-SERVERS.NET.
com. 77377 NS k2.ari.net.
com. 325800 NS H.RoT-SERVERS.NET.
com. 324155 NS B.RoT-SERVERS.NET.
com. 324155 NS C.RoT-SERVERS.NET.
com. 324155 NS D.RoT-SERVERS.NET.
com. 324155 NS E.RoT-SERVERS.NET.
com. 324155 NS I.RoT-SERVERS.NET.
com. 324155 NS F.RoT-SERVERS.NET.
com. 324155 NS G.RoT-SERVERS.NET.
com. 324155 NS A.RoT-SERVERS.NET.
com. 467325 NS C.ROOT-SERVERS.NET.
com. 467325 NS D.ROOT-SERVERS.NET.
'rot-server' ...