[Outages-discussion] [outages] Is UPS.COM down

L.T. Easterly corqpub at gmail.com
Sun Sep 4 23:13:50 EDT 2011


FWIW, my NSLookup via google's dns 8.8.8.8 has been accurate since realizing
I wasn't seeing the defacement earlier today:

via twitter: " RT @F4ls3Blu3 Netnames.co.uk <<<< Owned L O L "

Currently from my home connection and using googles' dns servers, this
subverts seeing the hijacked edition of any of the affected sites. Many
sites that continued to update the correct record may have mitigated the
spread of the bad records. I'm looking forward to what tomorrow's news cycle
makes of this.

I'm assuming that the UK server may not have proliferated the record far
(interesting that most were US-hosted sites, but attack launched via a UK
dns server, so, better luck next time, attackers.)




On Sep 4, 2011 9:28 PM, "Josh Luthman" <josh at imaginenetworksllc.com> wrote:
>
> DNS Cache.
>
>
http://en.wikipedia.org/wiki/Domain_Name_System#Recursive_and_caching_name_server
>
> In other words, the web server is not down but the DNS records are
broken.  To get around the broken part you can do as was suggested and etc
your hosts file (used before your DNS server, usually).
>
> Josh Luthman
> Office: 937-552-2340
> Direct: 937-552-2343
> 1100 Wayne St
> Suite 1337
> Troy, OH 45373
>
>
>
> On Sun, Sep 4, 2011 at 9:09 PM, Jeremy Chadwick <outages at jdc.parodius.com>
wrote:
>>
>> This response makes absolutely no sense with regards to the information
>> I provided.  Also, "cash server"?  End of thread for me.
>>
>> --
>> | Jeremy Chadwick                                jdc at parodius.com |
>> | Parodius Networking                       http://www.parodius.com/ |
>> | UNIX Systems Administrator                   Mountain View, CA, US |
>> | Making life hard for others since 1977.               PGP 4BD6C0CB |
>>
>> On Sun, Sep 04, 2011 at 08:00:33PM -0500, Mark Kierzkowski wrote:
>> > You can created local record on your dns server for ups.com for now
till there register fixes it.
>> >
>> > Here is dns record from Comcast cash servers for ups.com
>> >
>> > ups.com
>> > Non-authoritative answer:
>> > Name:??? ups.com
>> > Addresses:? 153.2.224.50, 153.2.228.50
>> > ?
>> >
>> >
>> >
>> > --------------------------
>> > Thanks.
>> > Mark Kierzkowski
>> >
>> > ----- Original Message -----
>> > From: Jeremy Chadwick [mailto:outages at jdc.parodius.com]
>> > Sent: Sunday, September 04, 2011 07:42 PM
>> > To: Mark Kierzkowski
>> > Cc: outages at outages.org <outages at outages.org>
>> > Subject: Re: [outages] Is UPS.COM down
>> >
>> > Which DNS servers?  It looks to me like nsa.ups.com and nsb.ups.comwork
>> > fine.  I didn't care to try the AT&T and Sprint authoritative NSes.
>> > Below is validation.
>> >
>> > My workplace relies heavily on UPS's web-based XML API for package
>> > status and tracking details, and none of our real-time monitoring has
>> > alerted for DNS issues or anything else pertaining to UPS today.
>> >
>> >
>> >
>> > $ dig @a.gtld-servers.net ns ups.com.
>> >
>> > ; <<>> DiG 9.6.-ESV-R5 <<>> @a.gtld-servers.net ns ups.com.
>> > ; (1 server found)
>> > ;; global options: +cmd
>> > ;; Got answer:
>> > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22371
>> > ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 6
>> > ;; WARNING: recursion requested but not available
>> >
>> > ;; QUESTION SECTION:
>> > ;ups.com.                       IN      NS
>> >
>> > ;; AUTHORITY SECTION:
>> > ups.com.                172800  IN      NS      nsa.ups.com.
>> > ups.com.                172800  IN      NS      nsb.ups.com.
>> > ups.com.                172800  IN      NS
cbru.br.ns.els-gms.att.net.
>> > ups.com.                172800  IN      NS
cmtu.mt.ns.els-gms.att.net.
>> > ups.com.                172800  IN      NS      ns1-auth.sprintlink.net
.
>> > ups.com.                172800  IN      NS      ns2-auth.sprintlink.net
.
>> >
>> > ;; ADDITIONAL SECTION:
>> > nsa.ups.com.            172800  IN      A       153.2.242.115
>> > nsb.ups.com.            172800  IN      A       153.2.244.155
>> > cbru.br.ns.els-gms.att.net. 172800 IN   A       199.191.128.105
>> > cmtu.mt.ns.els-gms.att.net. 172800 IN   A       12.127.16.69
>> > ns1-auth.sprintlink.net. 172800 IN      A       206.228.179.10
>> > ns2-auth.sprintlink.net. 172800 IN      A       144.228.254.10
>> >
>> > ;; Query time: 104 msec
>> > ;; SERVER: 192.5.6.30#53(192.5.6.30)
>> > ;; WHEN: Sun Sep  4 17:37:37 2011
>> > ;; MSG SIZE  rcvd: 276
>> >
>> >
>> > $ dig @nsa.ups.com a www.ups.com
>> >
>> > ; <<>> DiG 9.6.-ESV-R5 <<>> @nsa.ups.com a www.ups.com
>> > ; (1 server found)
>> > ;; global options: +cmd
>> > ;; Got answer:
>> > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16074
>> > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 9, ADDITIONAL: 5
>> >
>> > ;; QUESTION SECTION:
>> > ;www.ups.com.                   IN      A
>> >
>> > ;; ANSWER SECTION:
>> > www.ups.com.            300     IN      CNAME   www.ups.com.akadns.net.
>> > www.ups.com.akadns.net. 92      IN      CNAME
www.upsprodcidr2.com.akadns.net.
>> > www.upsprodcidr2.com.akadns.net. 15 IN  CNAME
www2.ups.com.edgekey.net.
>> > www2.ups.com.edgekey.net. 129   IN      CNAME   e1250.b.akamaiedge.net.
>> > e1250.b.akamaiedge.net. 5       IN      A       96.6.165.62
>> >
>> > ;; AUTHORITY SECTION:
>> > b.akamaiedge.net.       228     IN      NS      n4b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n6b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n1b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n5b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n2b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n8b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n3b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n0b.akamaiedge.net.
>> > b.akamaiedge.net.       228     IN      NS      n7b.akamaiedge.net.
>> >
>> > ;; ADDITIONAL SECTION:
>> > n2b.akamaiedge.net.     3393    IN      A       209.170.113.121
>> > n4b.akamaiedge.net.     919     IN      A       209.170.113.83
>> > n5b.akamaiedge.net.     217     IN      A       209.170.113.120
>> > n7b.akamaiedge.net.     919     IN      A       209.170.113.83
>> > n8b.akamaiedge.net.     3030    IN      A       209.170.113.83
>> >
>> > ;; Query time: 96 msec
>> > ;; SERVER: 153.2.242.115#53(153.2.242.115)
>> > ;; WHEN: Sun Sep  4 17:37:46 2011
>> > ;; MSG SIZE  rcvd: 422
>> >
>> >
>> > $ dig @nsb.ups.com a www.ups.com
>> >
>> > ; <<>> DiG 9.6.-ESV-R5 <<>> @nsb.ups.com a www.ups.com
>> > ; (1 server found)
>> > ;; global options: +cmd
>> > ;; Got answer:
>> > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9024
>> > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 9, ADDITIONAL: 6
>> >
>> > ;; QUESTION SECTION:
>> > ;www.ups.com.                   IN      A
>> >
>> > ;; ANSWER SECTION:
>> > www.ups.com.            300     IN      CNAME   www.ups.com.akadns.net.
>> > www.ups.com.akadns.net. 277     IN      CNAME
www.upsprodcidr2.com.akadns.net.
>> > www.upsprodcidr2.com.akadns.net. 7 IN   CNAME
www2.ups.com.edgekey.net.
>> > www2.ups.com.edgekey.net. 346   IN      CNAME   e1250.b.akamaiedge.net.
>> > e1250.b.akamaiedge.net. 20      IN      A       72.247.9.62
>> >
>> > ;; AUTHORITY SECTION:
>> > b.akamaiedge.net.       317     IN      NS      n3b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n4b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n2b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n5b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n1b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n6b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n8b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n0b.akamaiedge.net.
>> > b.akamaiedge.net.       317     IN      NS      n7b.akamaiedge.net.
>> >
>> > ;; ADDITIONAL SECTION:
>> > n1b.akamaiedge.net.     1534    IN      A       208.45.220.25
>> > n2b.akamaiedge.net.     2890    IN      A       208.45.220.24
>> > n4b.akamaiedge.net.     1077    IN      A       96.17.74.217
>> > n5b.akamaiedge.net.     336     IN      A       96.17.74.214
>> > n7b.akamaiedge.net.     1077    IN      A       96.17.74.217
>> > n8b.akamaiedge.net.     792     IN      A       96.17.74.218
>> >
>> > ;; Query time: 88 msec
>> > ;; SERVER: 153.2.244.155#53(153.2.244.155)
>> > ;; WHEN: Sun Sep  4 17:37:55 2011
>> > ;; MSG SIZE  rcvd: 438
>> >
>> > --
>> > | Jeremy Chadwick                                jdc at parodius.com |
>> > | Parodius Networking                       http://www.parodius.com/ |
>> > | UNIX Systems Administrator                   Mountain View, CA, US |
>> > | Making life hard for others since 1977.               PGP 4BD6C0CB |
>> >
>> > On Sun, Sep 04, 2011 at 07:26:02PM -0500, Mark Kierzkowski wrote:
>> > > Is anyone experiencing issues with ups.com site?
>> > >
>> > > Looks like dns servers are not resolving that domain.
>> > >
>> >
>> > > _______________________________________________
>> > > Outages mailing list
>> > > Outages at outages.org
>> > > https://puck.nether.net/mailman/listinfo/outages
>> _______________________________________________
>> Outages mailing list
>> Outages at outages.org
>> https://puck.nether.net/mailman/listinfo/outages
>
>
>
> _______________________________________________
> Outages mailing list
> Outages at outages.org
> https://puck.nether.net/mailman/listinfo/outages
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/outages-discussion/attachments/20110904/d9108665/attachment-0001.html>


More information about the Outages-discussion mailing list