Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It is all over the news today that Twitter was hacked by a DNS redirection/hijacking.

My question is, what tools or techniques do you guys use to monitor your DNS/whois and detect this kind of attacks?

share|improve this question

1 Answer 1

I run the Sucuri monitor (free) and it alerts me whenever the DNS/Whois is changed.

I have been monitoring twitter, facebook and other big sites for a while and that's the alert I got:

Sucuri nbim: twitter.com DNS modified

Modifications: 3a4
< twitter.com has address
< twitter.com has address
> twitter.com has address

--- This alert was generated by the Sucuri Network Integrity Monitor. Log in to your dashboard at http://sucuri.net.

But this is just a first line of defense/visibility to react faster. If you host your own DNS, you could do a FIM (file integrity monitor) to detect changes on it...

*posting what I do in here, to do not affect other answers. Plus, for the means of full-disclosure, I wrote the sucuri monitor :)

share|improve this answer
while asking and answering your own question is explicitly allowed, I think you should have waited a day or two for actual responses in this case. –  Jeff Atwood Dec 19 '09 at 11:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.