Google.com DNS server spam: "ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM" [Archive]

Patrick

12-07-2006, 03:18 PM

Which version of the script are you using? I updated the default configuration for .com nameserver a while ago I believe.

The FIRST thing I would do is install the updated version of the script directly from http://www.ep-dev.com/ . The reason is that your current settings seem to be using old settings (maybe you enabled some old configuration value accidentally?). Remember, the script works by default with com, net, org... and a bunch of others enabled (no additional configuration required).

Once you have installed the most recent version you will have everything working.

-------------------------

If you do not want to update to the most recent version with the correct configuration, you can try modifying the whois query for the .com nameserver. You will need to put "=" in front of it, making the entry be "=[[DOMAIN]].[[EXT]]" for both the normal query and the limit query boxes.

--------------------------

Anyway, what you are seeing at dnsstuff.com is the whois server output from google's servers. You may have this disabled in your current script. You can enable this output by going logging into the whois Admin Panel and:
1. Click "Whois Settings" page.
2. Change "Query Whois Server" to enabled.
3. Ensure that "Query Whois Server Regex (advanced)" is set to default string that is listed:

/(?:Whois Server|Registrar Whois): (.+)/i
4. Click "Save Config".

When you query a server, there are actually two queries:
1. You query the whois server such as crsnic.com
2. You query the domain's whois server for contact details.

The EP-Dev Whois script takes (2) if it is available and puts it ahead of (1). Otherwise, it just displays (1).

Remember to disable query caching while you are testing stuff in order to avoid old output.

I have just tested the script and it works out-of-the-box for correctly displaying google.com results:

MarkMonitor.com - The Leader in Corporate Domain Management
----------------------------------------------------------
For Global Domain Consolidation, Research & Intelligence,
and Enterprise DNS, go to: www.markmonitor.com
----------------------------------------------------------

(DOM-258879)
Please contact contact-admin@google.com
1600 Amphitheatre Parkway Mountain View
CA
94043 US

Domain Name: google.com

Registrar Name: Markmonitor.com
Registrar Whois: whois.markmonitor.com
Registrar Homepage: http://www.markmonitor.com

Administrative Contact:
DNS Admin
(NIC-14290820)
Google Inc.
1600 Amphitheatre Parkway Mountain View
CA
94043 US
dns-admin@google.com +1.6506234000 Fax- +1.6506188571
Technical Contact, Zone Contact:
DNS Admin
(NIC-1340144)
Google Inc.
2400 E. Bayshore Pkwy Mountain View
CA
94043 US
dns-admin@google.com +1.6503300100 Fax- +1.6506181499

Created on..............: 1997-Sep-15.
Expires on..............: 2011-Sep-14.
Record last updated on..: 2006-Sep-07 10:17:02.

Domain servers in listed order:

NS3.GOOGLE.COM
NS4.GOOGLE.COM
NS1.GOOGLE.COM
NS2.GOOGLE.COM

MarkMonitor.com - The Leader in Corporate Domain Management
----------------------------------------------------------
For Global Domain Consolidation, Research & Intelligence,
and Enterprise DNS, go to: www.markmonitor.com
----------------------------------------------------------

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Server Name: GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY .COM
IP Address: 69.41.185.195
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com

Server Name: GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
IP Address: 217.107.217.167
Registrar: ONLINENIC, INC.
Whois Server: whois.OnlineNIC.com
Referral URL: http://www.OnlineNIC.com

Server Name: GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERT JE.NET
IP Address: 62.41.27.144
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net

Server Name: GOOGLE.COM.VN
Registrar: ONLINENIC, INC.
Whois Server: whois.OnlineNIC.com
Referral URL: http://www.OnlineNIC.com

Server Name: GOOGLE.COM.UA
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com

Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
IP Address: 80.190.192.24
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net

Server Name: GOOGLE.COM.PLZ.GIVE.A.PR8.TO.AUDIOTRACKER.NET
IP Address: 213.251.184.30
Registrar: OVH
Whois Server: whois.ovh.com
Referral URL: http://www.ovh.com

Server Name: GOOGLE.COM.MX
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com

Server Name: GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
IP Address: 217.148.161.5
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Server Name: GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
IP Address: 213.228.0.43
Registrar: GANDI
Whois Server: whois.gandi.net
Referral URL: http://www.gandi.net

Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE .THAN.SECZY.COM
IP Address: 209.187.114.130
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com

Server Name: GOOGLE.COM.BR
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com

Server Name: GOOGLE.COM.AU
Registrar: PRIMUS TELCO PTY LTD DBA PRIMUSDOMAIN/PLANETDOMAIN
Whois Server: whois.planetdomain.com
Referral URL: http://www.planetdomain.com

Domain Name: GOOGLE.COM
Registrar: EMARKMONITOR INC. DBA MARKMONITOR
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com
Name Server: NS4.GOOGLE.COM
Name Server: NS3.GOOGLE.COM
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
Status: REGISTRAR-LOCK
EPP Status: clientUpdateProhibited
EPP Status: clientDeleteProhibited
EPP Status: clientTransferProhibited
Updated Date: 10-Apr-2006
Creation Date: 14-Sep-1997
Expiration Date: 13-Sep-2011

>>> Last update of whois database: Thu, 07 Dec 2006 16:13:20 EST <<<

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.