I was about to login to control panel of our hosting provider and it went to some other webpage which was not my hoster's server (I confirmed with them that the IP is not theirs)

mixdev@ThinkpadT430:~$ ping manage.softlayer.com
PING manage.softlayer.com ( 56(84) bytes of data.
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=1 ttl=47 time=286 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=2 ttl=47 time=285 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=3 ttl=47 time=287 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=4 ttl=47 time=294 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=5 ttl=47 time=284 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=6 ttl=47 time=285 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=7 ttl=47 time=310 ms
64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=8 ttl=47 time=285 ms
^C64 bytes from vps-1131725-16286.manage.myhosting.com ( icmp_req=9 ttl=47 time=285 ms

--- manage.softlayer.com ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 8005ms
rtt min/avg/max/mdev = 284.838/289.510/310.756/8.034 ms

This happens only with one ISP (Airtel) in all my machines (different OSes). All other ISP's show the correct page. No problem if I reconfigure to use Google DNS either. Running Ubuntu 12 LTS and my hosts file is clean.

My worry is that this is some attack on the domain manage.softlayer.com at ISP DNS level and someone did manage to successfully change it to another server of theirs. So, they can simply put a login page exactly like softlayer's and capture all my passwords (and all other users who happen to use the affected DNS server). Is this possible at all? How risky should one consider this situation?

[So I contacted the hosting provider about the problem and they claim that since the issue is not with their servers, they shouldn't act.]

  • Such an attack wouldn't work unless they successfully obtained an SSL certificate for manage.softlayer.com or against someone who didn't check that the page was secure before entering sensitive password information. The hosting provider is incorrect -- it is an issue with their servers -- it's their nameserver that's providing incorrect information. (And if they take that attitude, I wouldn't suggest using their nameservers.) – David Schwartz Oct 16 '13 at 21:39
  • What is the content of /etc/resolv.conf? – Michael Hampton Oct 16 '13 at 21:56

For optimal security, you should only use (a) DNS servers you can trust, and (b) an ISP you can trust.

You've informed the the ISP that they may be victims of a DNS cache poisoning attack or other attack on their resolving nameserver. If they don't think it's their problem, then you've got no other recourse but to find someone else who isn't so naive.

[Note, this is not a problem with softlayer; they have no control over your ISP's DNS servers]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.