[dns-operations] Hijacking of Google Public DNS in Turkey documented

[Alexander Neilson]

Other option here is to do a lookup at whoami.akamai.com and the DNS result is the IP address they got the DNS request from. 

Regards

Alexander

Alexander Neilson
Neilson Productions Ltd
Alexander at Neilson.net.nz
021 329 681

> On 30/03/2014, at 1:51 pm, Colm MacCárthaigh <colm at stdlib.net> wrote:
> 
> Does anyone know if the intercepting recursors are acting as standalone recursive nameservers, or if they are passing on the un-interesting queries to the "real" Google / OpenDNS resolvers?  
> 
> One way to tell is to observe the addresses being used towards authoritative name-servers.  http://whatsmyresolver.stdlib.net/ is one way to see this address. I'd be interested in the results, if anyone is in a position to test. 
> 
> 
>> On Sat, Mar 29, 2014 at 1:46 PM, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:
>> http://www.bortzmeyer.org/dns-routing-hijack-turkey.html
>> 
>> (with the help of RIPE Atlas probes)
>> _______________________________________________
>> dns-operations mailing list
>> dns-operations at lists.dns-oarc.net
>> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>> dns-jobs mailing list
>> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
> 
> 
> 
> -- 
> Colm
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20140330/655095b3/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6151 bytes
Desc: not available
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20140330/655095b3/attachment.bin>