1

So I was doing whois microsoft.com and this was the output:

MICROSOFT.COM.ARE.GODDAMN.PIGFUCKERS.NET.NS-NOT-IN-SERVICE.COM MICROSOFT.COM.CAN.GO.FUCK.ITSELF.AT.SECZY.COM MICROSOFT.COM.EENGURRA.COM MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET MICROSOFT.COM.HAS.A.PRESENT.COMING.FROM.HUGHESMISSILES.COM MICROSOFT.COM.IS.A.MESS.TIMPORTER.CO.UK MICROSOFT.COM.IS.A.STEAMING.HEAP.OF.FUCKING-BULLSHIT.NET MICROSOFT.COM.IS.HOSTED.ON.PROFITHOSTING.NET MICROSOFT.COM.IS.IN.BED.WITH.CURTYV.COM MICROSOFT.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET MICROSOFT.COM.IS.NOT.YEPPA.ORG MICROSOFT.COM.LIVES.AT.SHAUNEWING.COM MICROSOFT.COM.LOVES.ME.KOSMAL.NET MICROSOFT.COM.MAKES.RICKARD.DRINK.SAMBUCA.0800CARRENTAL.COM MICROSOFT.COM.MATCHES.THIS.STRING.AT.KEYSIGNERS.COM MICROSOFT.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM MICROSOFT.COM.RAWKZ.MUH.WERLD.MENTALFLOSS.CA MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.COM MICROSOFT.COM.SOFTWARE.IS.NOT.USED.AT.REG.RU MICROSOFT.COM.WAREZ.AT.TOPLIST.GULLI.COM MICROSOFT.COM.WILL.BE.BEATEN.WITH.MY.SPANNER.NET MICROSOFT.COM.WILL.BE.SLAPPED.IN.THE.FACE.BY.MY.BLUE.VEINED.SPANNER.NET MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET MICROSOFT.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM MICROSOFT.COM.ZZZZZZ.MORE.DETAILS.AT.WWW.BEYONDWHOIS.COM MICROSOFT.COM.ZZZZZZZZZZZZZZZZZZ.IM.ELITE.WANNABE.TOO.WWW.PLUS613.NET MICROSOFT.COM.ZZZZZZZZZZZZZZZZZZZ.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM MICROSOFT.COM.ZZZZZZZZZZZZZZZZZZZZZZ.IS.A.GREAT.COMPANY.ITREBAL.COM MICROSOFT.COM

I thought they were hacked but that's unlikely for such a big company, so I thought that these are non-authorative DNS entries.

  • Is that correct? If not, what is it then?
  • If so, how do I do this?
  • And can this be prevented with DNSSEC?

PS. There are multiple domains with this issue...

whois google.com

GOOGLE.COM.AFRICANBATS.ORG GOOGLE.COM.AR GOOGLE.COM.AU GOOGLE.COM.BEYONDWHOIS.COM GOOGLE.COM.BR GOOGLE.COM.CN GOOGLE.COM.CO GOOGLE.COM.DO GOOGLE.COM.HACKED.BY.JAPTRON.ES GOOGLE.COM.HANNAHJESSICA.COM GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM GOOGLE.COM.HK GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET GOOGLE.COM.LASERPIPE.COM GOOGLE.COM.LOLOLOLOLOL.SHTHEAD.COM GOOGLE.COM.MX GOOGLE.COM.MY GOOGLE.COM.NS1.CHALESHGAR.COM GOOGLE.COM.NS2.CHALESHGAR.COM GOOGLE.COM.PE GOOGLE.COM.PK GOOGLE.COM.RAINGUTTERPRO.COM GOOGLE.COM.SA GOOGLE.COM.SHQIPERIA.COM GOOGLE.COM.SOUTHBEACHNEEDLEARTISTRY.COM GOOGLE.COM.SPAMMING.IS.UNETHICAL.PLEASE.STOP.THEM.HUAXUEERBAN.COM GOOGLE.COM.SPROSIUYANDEKSA.RU GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM GOOGLE.COM.TR GOOGLE.COM.TW GOOGLE.COM.UA GOOGLE.COM.UY GOOGLE.COM.VABDAYOFF.COM GOOGLE.COM.VN GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERTJE.NET GOOGLE.COM.YUCEHOCA.COM GOOGLE.COM.YUCEKIRBAC.COM GOOGLE.COM.ZNAET.PRODOMEN.COM GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM GOOGLE.COM.ZZZZZZZZZZZZZ.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM GOOGLE.COM.ZZZZZZZZZZZZZZZZZZZZZZZZZZ.HAVENDATA.COM GOOGLE.COMMAS2CHAPTERS.COM GOOGLE.COM

whois apple.com

APPLE.COM.AT.WWW.BEYONDWHOIS.COM APPLE.COM.BEYONDWHOIS.COM APPLE.COM.HACKED.BY.JAPTRON.ES APPLE.COM.IS.0WN3D.BY.GULLI.COM APPLE.COM.IS.OWN3D.BY.NAKEDJER.COM APPLE.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM APPLE.COM.WAS.PWNED.BY.M1CROSOFT.COM APPLE.COM.WWW.BEYONDWHOIS.COM APPLE.COM.WWW.ZON.COM APPLE.COM.ZON.COM APPLE.COM

4
  • Where did you run this whois command, was this on a local computer of yours, or what?
    – Zoredache
    Aug 15, 2014 at 21:53
  • For the record, an non-authoritative DNS response just simply means that the nameserver answering the query is not the nameserver of record for the domain. It's a pretty normal thing and unrelated to the problem you have which I suspect is malware related I but have no idea which direction for you to follow.
    – Tyson
    Aug 16, 2014 at 1:41
  • @Zoredache Yes.
    – William
    Aug 16, 2014 at 5:19
  • @Tyson I don't have a problem (malware). Try a Google search for whois microsoft hacked (even though it isn't).
    – William
    Aug 16, 2014 at 5:20

3 Answers 3

1

The WHOIS command you're using isn't working correctly. Valid WHOIS data would look something like this:

Domain Name: MICROSOFT.COM
Registrar: MARKMONITOR INC.
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com
Name Server: NS1.MSFT.NET
Name Server: NS2.MSFT.NET
Name Server: NS3.MSFT.NET
Name Server: NS4.MSFT.NET
Name Server: NS5.MSFT.NET
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Status: serverDeleteProhibited
Status: serverTransferProhibited
Status: serverUpdateProhibited
Updated Date: 09-aug-2011
Creation Date: 02-may-1991
Expiration Date: 03-may-2021

>>> Last update of whois database: Fri, 15 Aug 2014 21:25:44 UTC <<<

In fact, it looks like the data you're getting is nothing more than a list of DNS hostnames that contain the search term you are using. Take for example, the third result in your microsoft.com query:

 MICROSOFT.COM.EENGURRA.COM

DNS hostnames are interpreted from right to left. That means in this case the domain name is EENGURRA.COM. Whoever controls eengurra.com can create whatever subdomains and hostnames in their domain that they want. These are added to the left of their domain name.

In this case, eengurra.com created the subdomain com and in that subdomain they created a hostname microsoft. The result is the hostname microsoft in the domain com.eengurra.com. Put them together and you get microsoft.com.eengurra.com, which, despite appearing associated with microsoft.com, is nothing more than a deceiving manipulation of DNS entries all within the domain controlled by the owner of eengurra.com.

1
  • OK, thanks. I am using the standard WHOIS tool in Mac OS X by the way.
    – William
    Aug 16, 2014 at 5:22
0

The whois systems is only tangentially related to DNS. It does not use the DNS protocol, it is not required for the DNS protocol to work. It is is a completely separate database and protocol. Your whois client is almost certainly pointing to a whois server with invalid data, or somehow your request is being redirected to a bad whois server. There are several different whois

DNSSEC wouldn't help anything, since this isn't whois isn't DNS.

I would take the time to try and isolate how your whois requests are being subverted. Some kind of malware could have updated the configuration for your whois client pointing you at invalid whois server, or perhaps malware as completely replaced the whois binary.

1
-2

-whois doesn't only list domain names, it also lists name server records.

People probably created name server records for their domains with those messages in the host name of their name servers. These are probably not real hosts, but they do appear in the queries queries.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .