Screwy authoritative servers

[Host Master]

Try this on for size...

Whois Server Version 1.3

Domain names in the .com, .net, and .org domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

    Domain Name: CREDIT---CARDS.NET
    Registrar: BULKREGISTER.COM, INC.
    Whois Server: whois.bulkregister.com
    Referral URL: www.bulkregister.com
    Name Server: BORS.NANDO.NET
    Name Server: DNS1.AMERICAN-DATA.NET
    Name Server: DNS1.AIC.FR
    Name Server: FALCON.ASAHI-NET.OR.JP
    Name Server: NS.EUNET.SK
    Name Server: NS.ADMIRAL.RU
    Name Server: SAVBA.SAVBA.SK
    Name Server: SERVER1.POP-DF.RNP.BR
    Name Server: NS3.SPHERE.AD.JP
    Name Server: DNS1.CADE.COM.BR
    Name Server: ROA.LORANET.NET
    Updated Date: 19-apr-2001


 >>> Last update of whois database: Mon, 23 Apr 2001 07:35:40 EDT <<<

The Registry database contains ONLY .COM, .NET, .ORG, .EDU domains and
Registrars.


Found InterNIC referral to whois.bulkregister.com.

credit--- cards.net
    12 logana
    Eslapienda, carobo 12009
    CU

    Domain Name: CREDIT---CARDS.NET

    Administrative Contact:
         hava hastam    hastam at hotmail.com
         credit---cards.net
         12 logana
         Eslapienda, carobo 12009
         CU
         Phone- 2153421
         Fax-
    Technical Contact:
         hava hastam  hastam at hotmail.com
         credit---cards.net
         12 logana
         Eslapienda, carobo 12009
         CU
         Phone- 2153421
         Fax-

    Record updated on 2001-04-19 20:20:33.
    Record created on 2001-04-19.
    Record expires on 2002-04-19.
    Database last updated on 2001-04-23 10:15:25 EST.

    Domain servers in listed order:

    SERVER1.POP-DF.RNP.BR         200.19.119.125
    BORS.NANDO.NET                152.52.2.39
    DNS1.AMERICAN-DATA.NET        204.85.10.194
    DNS1.AIC.FR                   62.8.0.35
    FALCON.ASAHI-NET.OR.JP        202.224.32.2
    DNS1.CADE.COM.BR              200.244.143.130
    ROA.LORANET.NET               216.65.112.202
    NS3.SPHERE.AD.JP              202.239.113.22
    NS.EUNET.SK                   192.108.130.33
    NS.ADMIRAL.RU                 194.105.200.1
    SAVBA.SAVBA.SK                147.213.1.1



Nslookup output...

Non-authoritative answer:
CREDIT---CARDS.NET      nameserver = BORS.NANDO.NET
CREDIT---CARDS.NET      nameserver = DNS1.AMERICAN-DATA.NET
CREDIT---CARDS.NET      nameserver = DNS1.AIC.FR
CREDIT---CARDS.NET      nameserver = FALCON.ASAHI-NET.OR.JP
CREDIT---CARDS.NET      nameserver = NS.EUNET.SK
CREDIT---CARDS.NET      nameserver = NS.ADMIRAL.RU
CREDIT---CARDS.NET      nameserver = SAVBA.SAVBA.SK
CREDIT---CARDS.NET      nameserver = SERVER1.POP-DF.RNP.BR
CREDIT---CARDS.NET      nameserver = NS3.SPHERE.AD.JP
CREDIT---CARDS.NET      nameserver = DNS1.CADE.COM.BR
CREDIT---CARDS.NET      nameserver = ROA.LORANET.NET

Authoritative answers can be found from:
BORS.NANDO.NET  internet address = 152.52.2.39
DNS1.AMERICAN-DATA.NET  internet address = 204.85.10.194
ROA.LORANET.NET internet address = 216.65.112.202

At 03:10 PM 4/23/01 -0700, John Oliver wrote:

>credit---cards.net
>
>Every time I look up the authoritative servers, I get ~12, several
>change each time, and none actually are authoritative.  But I can
>nslookup www.credit---cards.net every time with no problem.  This is a
>spammer trying to hide their ISP to avoid LARTs.  I'm very interested in
>*how* this is accomplished so I can drop a bomb on them next time... :-)
>
>--
>John Oliver, System Administrator        http://www.allegiancetele.com
>ConnectNet, an Allegiance Telecom company    http://www.connectnet.com
>6370 Lusk Blvd. Ste F103                                (858) 638-2020
>San Diego, CA. 92121                               FAX: (858) 623-1505