[dns-operations] Hijacking of Google Public DNS in Turkey documented

Stephane Bortzmeyer bortzmeyer at nic.fr
Sun Mar 30 14:57:12 UTC 2014


> http://www.bortzmeyer.org/dns-routing-hijack-turkey.html

Here is the result of a lookup of whoami.akamai.net from the ten
turkish RIPE Atlas probes:

[74.125.18.80] : 2 occurrences
[195.175.255.66] : 8 occurrences

74.125.18.80 is Google, 195.175.255.66 Turkish Telecom. So, no, Google
Public DNS is not proxied but replaced by an impostor which is a full
recursor.

[All measurements show that 2 Atlas probes in Turkey do not see the
hijacking (the first two in the output above). I don't know why these
two are spared.]



More information about the dns-operations mailing list