Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is all over the news today that Twitter was hacked by a DNS redirection/hijacking.

My question is, what tools or techniques do you guys use to monitor your DNS/whois and detect this kind of attacks?

share|improve this question

I run the Sucuri monitor (free) and it alerts me whenever the DNS/Whois is changed.

I have been monitoring twitter, facebook and other big sites for a while and that's the alert I got:

Sucuri nbim: DNS modified

Modifications: 3a4
< has address
< has address
> has address

--- This alert was generated by the Sucuri Network Integrity Monitor. Log in to your dashboard at

But this is just a first line of defense/visibility to react faster. If you host your own DNS, you could do a FIM (file integrity monitor) to detect changes on it...

*posting what I do in here, to do not affect other answers. Plus, for the means of full-disclosure, I wrote the sucuri monitor :)

share|improve this answer
while asking and answering your own question is explicitly allowed, I think you should have waited a day or two for actual responses in this case. – Jeff Atwood Dec 19 '09 at 11:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.