Forum Moderators: phranque

Message Too Old, No Replies

HELP! Nameservers changed?

         

tflcr

8:06 pm on Dec 7, 2011 (gmt 0)

10+ Year Member



hello - I'm hoping someone can help me out with some ideas.

About 90 minutes ago I noticed websites not being available on my dedicated server.

I'm using whm.
Logged in - everything looks normal.
Until I look at my nameservers.

I have 4 different nameservers (for legacy reasons): 2 different sets on 2 TLDs amd I'm running about 50 sites on the box - all using one set or the other.

Somehow the namserver IP addresses for all 4 nameservers have been chnaged to a different single IP address somewhere in the States.

I'm at a loss as to how this has happened and also how to fix it. I've logged a call with the datacentre but it's evneing here and I guess they'll take at least 4 hours to respond.

I have not had this occur before. How have the nameserver IP addresses changed? Also, how can I change them back.

Has this been done via the DNS system external to my server or has it been hacked?

Any help would be very gratefully received - I will soon have customers shouting at me.

phranque

7:51 am on Dec 8, 2011 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



welcome to WebmasterWorld, tflcr!

are you saying all four of your nameservers (for example: ns1.example.com, ns2.example.com, etc) all resolve to the same IP address?
that would be very unusual - especially if they are 2 pairs from autonomous organizations.
there is nothing in your control that you can do about this unless your zone file is actually pointing to IP addresses instead of hostnames in the NS records of the zone file.
if this is the case then perhaps your zone file was hacked.