4 ms·
Ask HN: Why does whois on Facebook.com return spam web addresses?
I was just playing around with a friend's app http://netcomber.com/ and I noticed the whois information for Facebook returns:
FACEBOOK.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
FACEBOOK.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM
FACEBOOK.COM.LOVED.BY.WWW.SHQIPHOST.COM
FACEBOOK.COM.KNOWS.THAT.THE.BEST.WEB.HOSTING.IS.NASHHOST.NET
FACEBOOK.COM.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM
FACEBOOK.COM.DISABLE.YOUR.TIMELINE.NOW.WITH.THE.ORIGINAL.TIMELINE-REMOVE.NET
FACEBOOK.COM
It is the same on my local machine and on my various VPS boxes. Why is this the case? How does an attack/hijacking like this occur?
- erichurkman 13y agoThose are all name servers published by the top level domain, like `SWINGINGCOMMUNITY.COM`. When you do a whois search for `facebook.com` it searches for any name server records beginning with `facebook.com`.