It's official, hell has frozen over...

Maybe DNS servers in for his ISP are affected?

I know that several large sites were suffering a DNS cache poison attack several days ago?
Maybe the attackers are refining their attack?

Weird that it is redirecting to yahoo... before the attackers were redirecting to

EDIT: Don't go to these domains!
www.7sir7.com
123xxl.com
abx4.com
/EDIT: Don't go to these domains!

They were redirecting to install spyware on your PC.

Maybe I just don't see it because my DNS for those domains redirects to 0.0.0.0
They say those domains are/were using dynamic DNS...

There is an update on the DNS cache poison attacks at incidents.org

http://isc.sans.org//index.php

If you're looking at this other than today, You'll want to look at the

Handler's Diary March 13th 2005

dns issue... I'm getting IP 64.233.161.104, no response, the ip duck gave me brought up GOOGLE, PRECIOUS GOOGLE, I'll never take you for granted again!!! weird, must be a local dns server with a bad entry for google

The Duck,

When I do it I get this:

Quote:

---

C:\Documents and Settings\MsM>ping www.google.com

Pinging www.google.akadns.net [64.233.187.99] with 32 bytes of data:

Reply from 64.233.187.99: bytes=32 time=2510ms TTL=240
Reply from 64.233.187.99: bytes=32 time=73ms TTL=240
Reply from 64.233.187.99: bytes=32 time=86ms TTL=240
Reply from 64.233.187.99: bytes=32 time=89ms TTL=240

Ping statistics for 64.233.187.99:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 73ms, Maximum = 2510ms, Average = 689ms

---

it only sent me to yahoo on IE, so its probably the default search page for IE, I don't know, I rarely use it

Google has multiple IP's, maybe you got a different one because your located in canada??

Quote:

---

Pinging www.google.akadns.net [216.239.57.147] with 32 bytes of data:

Reply from 216.239.57.147: bytes=32 time=75ms TTL=241
Reply from 216.239.57.147: bytes=32 time=62ms TTL=241
Reply from 216.239.57.147: bytes=32 time=63ms TTL=241
Reply from 216.239.57.147: bytes=32 time=61ms TTL=241

Ping statistics for 216.239.57.147:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 61ms, Maximum = 75ms, Average = 65ms

---

I get the 64.233.161.104 address when I ping.

Could just be different because of clustering. They are just spreding the load across several servers. Its not uncommon for people to get different servers. Especially when several countries are involved.

That's what I meant phish, I just suck at wording things :D...

I'm not in canada, and phishphreek80 is getting the same IP I am and I assume he's able to reach google... this is weirdness. but I have your google IPs, if it goes on for too long I'll add them to my hosts file for convenience purposes

try using explorer too, not IE but explorer, open up a folder and type in www.google.com, see if that works, I know since it is giving you an ip via dns resolution you may think its fine but is it possible it cached the ip? try http://64.233.167.147 see if that works?

i may consider flushing your dns also....
open a cmd prompt and type in
ipconfig /flushdns
then
ipconfig /registerdns

see if that fixes it, if not I think msm has the next best solution

ok, now I'm getting this IP:

Quote:

---

Pinging google.com [216.239.39.99] with 32 bytes of data:

Reply from 216.239.39.99: bytes=32 time=48ms TTL=241
Reply from 216.239.39.99: bytes=32 time=34ms TTL=241
Reply from 216.239.39.99: bytes=32 time=53ms TTL=241
Reply from 216.239.39.99: bytes=32 time=33ms TTL=241

Ping statistics for 216.239.39.99:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 33ms, Maximum = 53ms, Average = 42ms

---

This proves our theory, it looks as though the server you go to depends on the amount of people using google at a given time...