Forum Moderators: phranque

Message Too Old, No Replies

Google.com DNS hacked for a short time today?

         

SumGuy

2:15 pm on Feb 24, 2019 (gmt 0)

5+ Year Member Top Contributors Of The Month



This isin't about search engines per-se, but it is about google, so I decided to post it here.

At some point before 8 am EST today, I began noticing that google.com (aka www.google.com) wasn't reachable from my PC. I had internet connectivity otherwise. I have google.com / www.google.com entries in my hosts file (in case of DNS failure I can still reach many websites).

The entries I had for google.com at the time were 172.217.2.164.

I disabled those and found that the dns lookups had changed to 184.168.131.241. I updated my hosts file to that IP.

About 1/2 hour later, google.com was failing again, but this time I was seeing that google search queries were being redirected to:

===============
[shortener.secureserver.net...]

Destination
Unknown
Everything's working on our side, so the link you clicked is either wrong or has been retired.
===============

Again I disabled my hosts file and found that google.com DNS had changed again, this time to 172.217.1.4.

So was this a hack? Or a planned DNS change - with a detour through Godaddy?

I very very rarely make a change to my google.com/www.google.com hosts file entry, so this event really looks suspicious.

engine

1:46 pm on Apr 25, 2019 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I assume this was a one-off and you've not seen this happen again.