When a network intel provider’s domain serves fraudulent content, something is wrong

guest · Nov 15, 2018

When a network intel provider’s domain serves fraudulent content, something is wrong
ThousandEyes falls prey to the type of DNS goof it helps customers avoid
November 15, 2018
https://arstechnica.com/information...domain-served-fraudulent-content-for-2-weeks/

ThousandEyes, a San Francisco-based network intelligence service [...] has struggled with its own networking blunder that allowed scammers to host hundreds of thousands of fraudulent documents on its very own domain.

To park their content, the scammers took advantage of a lapse in the management of the ThousandEyes.com domain. An entry in the domain’s authoritative name servers pointed to the IP address [...]
ThousandEyes used the IP in the past, but at some point it stopped doing so. ThousandEyes admins, however, failed to remove the DNS entry from the name servers.

"This was a stale DNS record from decommissioned infrastructure that was pointing to an IP address that we no longer use. The hosting provider re-used that IP address, and someone hosted those PDFs using that IP address. [...] There was no compromise of our hosting [...]"

This is technically true. But it’s also true that ThousandEyes’ infrastructure was linked to a fraudulent IP address and that the lapse went undetected for about two weeks. That’s a serious error for a service that’s supposed to help other companies detect these same sorts of problems.
Click to expand...

Log in or Sign up

When a network intel provider’s domain serves fraudulent content, something is wrong

guest Guest

Log in or Sign up

When a network intel provider’s domain serves fraudulent content, something is wrong

guest Guest

Useful Searches