3 ms·
This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17 I'm trying to find other subdomains that mig
by nikcub 13y ago
This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17
I'm trying to find other subdomains that might be still pointing there.
edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11
edit: 96 records still pointing at the rogue server, here is a dump I just uploaded:
http://pastebin.com/uc2JXPfB http://pastebin.com/uc2JXPfB
- meatmanek 13y agoWhat nameserver are you using?
- nikcub 13y agoagainst their primary NS ns1.linkedin.com short TTL's on a lot of these domains I just ran it again this time using Google name servers and still a lot of subdomains are pointing to the 214 server. confirmed it running against their NS, which means it hasn't been changed yet.
- wavefunction 13y agoI've got my nameservice hardset through openDNS and it's resolving to 198.55.195.121, which is allocated to NASDAQ OMX according to ARIN... The 214.-.-.- is some British Virgin Islands allocation?
- nikcub 13y agoI just got a message on twitter that 214.11 might be a DDoS mitigation service.. have emailed linkedin to find out what is what.