[dns-operations] Typo in fox.com and an Akamai squatter

[Chris Adams]

One of my customers for which I manage recursive DNS servers ran into a
problem: fox.com was resolving to 185.45.13.88 for their customers
(which appears to be serving malware).

Digging into the cache, it appears the problem is a typo in the NS
records for fox.com:

$ dig +short fox.com ns
;; Truncated, retrying in TCP mode.
a23-73-133-237.deploy.static.akamaitechnologies.com.
a72-247-151-10.deploy.akamaitechnologies.com.
a72-247-45-157.deploy.akamaitechnologies.com.
a72-246-0-10.deploy.akamaitechnologies.com.
a23-73-134-237.deploy.static.akamaitechnologies.com.
a72-247-45-25.deploy.akamaitechnologies.com.
a72-247-45-110.deploy.akamaitechnologies.co.
a72-246-192-168.deploy.akamaitechnologies.com.
a23-73-133-141.deploy.static.akamaitechnologies.com.
zl1-east.akamai.com.
a60-254-128-45.deploy.akamaitechnologies.com.
zl1-west.akamai.com.
a23-73-134-141.deploy.static.akamaitechnologies.com.
a72-247-45-65.deploy.akamaitechnologies.com.
fw01.cmbrmaks.akamai.com.
a193-108-152-143.deploy.akamaitechnologies.com.

Note that they are all "akamai.com." or "akamaitechnologies.com.",
except for one that is "akamaitechnologies.co." (.co not .coM).
a72-247-45-110.deploy.akamaitechnologies.co. resolves to the bogus IP
(with a link-local AAAA record), so I am guessing that the
akamaitechnologies.co domain is a squatter (wonder how many other
domains have such typos).

Anybody have a contact at fox.com and/or Akamai?
-- 
Chris Adams <cma at cmadams.net>