4 ms·

What's weird is I've seen hover.com set up a legitimate, normal "this site under construction" page before, on another new domain. So this isn't their normal de

What's weird is I've seen hover.com set up a legitimate, normal "this site under construction" page before, on another new domain. So this isn't their normal default page. However- I looked at this some more after posting here, and noticed the domain was actually pointed at Cloudflare name-servers, not hover's. I don't remember doing that for this domain, though I do have some other domains that I'd fully transferred from hover.com to Cloudflare in the past (and use the same domain servers), so maybe hover.com somehow guessed that I wanted those name servers for this one too? But a concerning thing is that I haven't actually told Cloudflare about this domain at all- it's not on my account there. So it's using their name-servers, but I can't actually manage the records because it's not associated with my Cloudflare account? I used nslookup.io to check the current records and saw this (reiterating that these are probably malicious IPs!): A: 172.67.186.129 A: 104.21.1.36 So that's probably where I was being taken to. Not sure what else can be determined from it. I have no idea how this chain of events played out and it's very concerning. I wish I understood this stuff better.

toast0 4y ago
Hover has a concept of default NS records... If you have those set to cloudflare and bought a new domain without configuring that... Then if you didn't claim your domain on cloudflare, I think someone else can if the NS records are pointing to them. This is a common issue with many services where they don't validate domain control, but will provision services to the first user who asks if the domain is pointed at the service.
- brundolf 4y ago
  That's horrifying. But it's the first plausible explanation I've heard, so thank you I've started the process of moving the domain to porkbun. After this I'll probably delete my hover.com account.
  - arcbyte 4y ago
    If I'm understanding gp correctly, porkbun won't be any better. The issue is with cloud flare. Just change the NS on hover to point it where you want it. Hover has a very nice UI for this.
    - brundolf 4y ago
      If I understood them correctly, hover has a (terrible) mechanism where if you've changed your NS to a third party for some domain, it automatically sets all new registered domains to the same NS. This would then leave you wide open to this sort of attack unless you make sure to immediately go on that third-party and associate each new domain with your account there too. So it could be solved by going back to first-party NS on hover (though I couldn't figure out in their UI how to do this), but the overall poor decision on their part undermines my confidence in their entire service, so that's why I'm switching registrars (I'd already seen people on here praise porkbun, I just didn't have a specific reason to go through the transfer process)
      - toast0 4y ago
        It's been a while since I used hover, but I wouldn't consider it horrible, and I think you had to set it as an account setting, I don't think it happened by default... But if I obtain a new domain, of course I want it to point at my existing DNS servers, that's what they're for. In general, it's hard to know which nameservers are going to do the wrong thing with that, and I don't want to use my registrar's DNS ever, but many registries prohibit registering names without setting NS records, so what do you want them to do?
        brundolf 4y ago
        Putting it on the registrar's servers to begin with would be safest, because they already know you have control of that domain (so nobody else could usurp NS control out from under you). I can understand the convenience of being able to set a different default, but it seems like a huge footgun to leave open, especially if it happens automatically (which, I don't remember ever setting a default on purpose)

toast0 4y ago

Hover has a concept of default NS records... If you have those set to cloudflare and bought a new domain without configuring that... Then if you didn't claim your domain on cloudflare, I think someone else can if the NS records are pointing to them. This is a common issue with many services where they don't validate domain control, but will provision services to the first user who asks if the domain is pointed at the service.

brundolf 4y ago
That's horrifying. But it's the first plausible explanation I've heard, so thank you I've started the process of moving the domain to porkbun. After this I'll probably delete my hover.com account.
- arcbyte 4y ago
  If I'm understanding gp correctly, porkbun won't be any better. The issue is with cloud flare. Just change the NS on hover to point it where you want it. Hover has a very nice UI for this.
  - brundolf 4y ago
    If I understood them correctly, hover has a (terrible) mechanism where if you've changed your NS to a third party for some domain, it automatically sets all new registered domains to the same NS. This would then leave you wide open to this sort of attack unless you make sure to immediately go on that third-party and associate each new domain with your account there too. So it could be solved by going back to first-party NS on hover (though I couldn't figure out in their UI how to do this), but the overall poor decision on their part undermines my confidence in their entire service, so that's why I'm switching registrars (I'd already seen people on here praise porkbun, I just didn't have a specific reason to go through the transfer process)
    - toast0 4y ago
      It's been a while since I used hover, but I wouldn't consider it horrible, and I think you had to set it as an account setting, I don't think it happened by default... But if I obtain a new domain, of course I want it to point at my existing DNS servers, that's what they're for. In general, it's hard to know which nameservers are going to do the wrong thing with that, and I don't want to use my registrar's DNS ever, but many registries prohibit registering names without setting NS records, so what do you want them to do?
      - brundolf 4y ago
        Putting it on the registrar's servers to begin with would be safest, because they already know you have control of that domain (so nobody else could usurp NS control out from under you). I can understand the convenience of being able to set a different default, but it seems like a huge footgun to leave open, especially if it happens automatically (which, I don't remember ever setting a default on purpose)