Ask HN: Spam on the domain I just purchased? | Hacker News Reader

Ask HN: Spam on the domain I just purchased?

13 pointsbrundolf8 comments

I registered a domain name a couple months ago (via hover.com if that matters). Just now I visited it to see what the default/empty splash-page looks like, and got redirected through several different sites in different languages (one of which looked like a spammy recipe site? the rest went by so fast they didn't fully load)

Needless to say, this was highly sketchy and I'm now wondering if I need to take steps to lock down my various accounts since I feel like I just visited a malicious link

But what I'm really wondering is, how did this happen with a newly-registered domain that I own? I deleted all the existing DNS records after it happened, but assuming those were the cause of all this, how did malicious ones get there in the first place? hover.com seems like the only party that should have been able to do this, but they've never shown themselves to be a malicious actor in the past. Does a domain keep its previous DNS records when it gets bought by a new owner who didn't get it via a transfer? Do those not normally get reset by the registrar?

Addendum: Anybody know a good malware scanner for macOS? :P

Have you got the original entries available? Without them it's hard to tell what happened. If you want some speculation though, hover may be using some specific parked page provider who is doing dodgy stuff. Third party parked pages are a terrible idea in general.

What's weird is I've seen hover.com set up a legitimate, normal "this site under construction" page before, on another new domain. So this isn't their normal default page.

However- I looked at this some more after posting here, and noticed the domain was actually pointed at Cloudflare name-servers, not hover's. I don't remember doing that for this domain, though I do have some other domains that I'd fully transferred from hover.com to Cloudflare in the past (and use the same domain servers), so maybe hover.com somehow guessed that I wanted those name servers for this one too? But a concerning thing is that I haven't actually told Cloudflare about this domain at all- it's not on my account there. So it's using their name-servers, but I can't actually manage the records because it's not associated with my Cloudflare account?

I used nslookup.io to check the current records and saw this (reiterating that these are probably malicious IPs!):

  A: 172.67.186.129
  A: 104.21.1.36

So that's probably where I was being taken to. Not sure what else can be determined from it.

I have no idea how this chain of events played out and it's very concerning. I wish I understood this stuff better.

Hover has a concept of default NS records... If you have those set to cloudflare and bought a new domain without configuring that...

Then if you didn't claim your domain on cloudflare, I think someone else can if the NS records are pointing to them. This is a common issue with many services where they don't validate domain control, but will provision services to the first user who asks if the domain is pointed at the service.

That's horrifying. But it's the first plausible explanation I've heard, so thank you

I've started the process of moving the domain to porkbun. After this I'll probably delete my hover.com account.

If I'm understanding gp correctly, porkbun won't be any better. The issue is with cloud flare. Just change the NS on hover to point it where you want it. Hover has a very nice UI for this.

If I understood them correctly, hover has a (terrible) mechanism where if you've changed your NS to a third party for some domain, it automatically sets all new registered domains to the same NS. This would then leave you wide open to this sort of attack unless you make sure to immediately go on that third-party and associate each new domain with your account there too.

So it could be solved by going back to first-party NS on hover (though I couldn't figure out in their UI how to do this), but the overall poor decision on their part undermines my confidence in their entire service, so that's why I'm switching registrars (I'd already seen people on here praise porkbun, I just didn't have a specific reason to go through the transfer process)

It's been a while since I used hover, but I wouldn't consider it horrible, and I think you had to set it as an account setting, I don't think it happened by default...

But if I obtain a new domain, of course I want it to point at my existing DNS servers, that's what they're for. In general, it's hard to know which nameservers are going to do the wrong thing with that, and I don't want to use my registrar's DNS ever, but many registries prohibit registering names without setting NS records, so what do you want them to do?

Putting it on the registrar's servers to begin with would be safest, because they already know you have control of that domain (so nobody else could usurp NS control out from under you). I can understand the convenience of being able to set a different default, but it seems like a huge footgun to leave open, especially if it happens automatically (which, I don't remember ever setting a default on purpose)

Reply on news.ycombinator.com