phishing site

Paul A razor at meganet.net
Thu Jan 31 21:35:57 UTC 2008


Hi it looks like my name server, BIND 9.3.2-P1 was used to setup and
phishing DNS zone, although the zone might have been setup forwhile. 
Zone: nhscb.com

It looks like someone entered some wildcard records 

localhost       IN A    127.0.0.1
*.bancaroma     IN A    67.62.31.111
*.it            IN A    67.62.31.111

My question is, is this a case of dns poising, can someone explain how It
happened and what I can do to prevent it.

Thanks,
 
paul





More information about the bind-users mailing list