FIOS DNS Hack Directed to unallocated.barefruit.co.uk92.242.140.21

[#1]

For the past 3 days the DNS for me (and people I know from work that have FIOS) has been correupted by what appears to be a DNS hack / re-direct to barefruit.co.uk92.242.140.21. This is causing super slow resolve times for websites, super SLOW connection times for the office VPN and lack of DNS at home to reach machines via their hostnames (IP address works).

I logged a ticket two days ago to Verizon but this is still an issue. Can the real network (not voice) engineers at Verizon resolve this ?

Example: (code1.emi.philips.com appends from our office naming convention)

nslookup www.cnn.com
Server:  Wireless_Broadband_Router.home
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.cnn.com.code1.emi.philips.com
Address:  92.242.140.21

General IP Information
IP: 92.242.140.21
Decimal: 1559399445
Hostname: unallocated.barefruit.co.uk
ISP: Barefruit Ltd.
Organization: Barefruit Ltd.
Services: None detected
Type: 
Assignment: Static IP

[#2]

This is a peer support group.  We are users just like you.

You need to contact tech support if it is still an issue.

[#3]

This might be the result of Verizon's DNS redirection on nxdomain responses. It's possible Verizon's DNS is yet again broken.

If you want to use Verizon's DNS services instead of servers like OpenDNS, do this. Take the IP addresses of the DNS Servers your router shows, and change the last digit from 12 to 14. This will give you proper DNS. If changing the DNS Sever doesn't fix the problem, let us know.

[#4]

Good option, also try emailing that kind of issue to DNS@verizon.com and see if they can help.

[#5]

if it's a dns hack, changing your dns would fix it.

if that doesn't fix it, you might have a different problem, in that case post a traceroute

[#6]

Monday August 4th 6AM EST

I noticed this address as well. Outgoing excerpt from my router log '92.242.140.21:427'.

Who is results . . .

[Querying whois.arin.net]
[Redirected to whois.ripe.net:43]
[Querying whois.ripe.net]
[whois.ripe.net]
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '92.242.140.0 - 92.242.140.255'

% Abuse contact for '92.242.140.0 - 92.242.140.255' is 'abuse@barefruit.co.uk'

inetnum:        92.242.140.0 - 92.242.140.255
netname:        BAREFRUIT-ERRORHANDLING
descr:          BAREFRUIT-US-ANYCAST-A
country:        GB
org:            ORG-BL53-RIPE
admin-c:        PR42-RIPE
tech-c:         PR42-RIPE
status:         ASSIGNED PA
mnt-by:         CATALYST2-MNT
source:         RIPE # Filtered

{Edited to comply with guidelines}


mnt-by:         CATALYST2-MNT
source:         RIPE # Filtered
nic-hdl:        PR42-RIPE

% Information related to '92.242.140.0/24AS45028'

route:          92.242.140.0/24
descr:          BF-MC-1
origin:         AS45028
mnt-by:         CATALYST2-MNT
source:         RIPE # Filtered

[#7]

I work as a System Admin in the Northeast for a mid sized company, we started seeing this last week on Wednesday (July 30th)

VPN'd users on FiOS are having all sorts of name resolution issues, everything resolves to this address even if it doesn't exist (should return NXDOMAIN), as soon as we change the user's local DNS from Verizon to Google / Open DNS etc. everything starts working again.

This is extremely frustrating (I'm a FiOS customer as well) I opened a ticket and they denied any issues with their DNS and to top it off the network technician refused to talk to me on the phone and rather suggesting it's all "on our end".... The issue was swept under the rug instead of being seriously dealt with.

[#8]

This problem caused havoc with our VPN as well which is how we discovered it.  Switching DNS severs fixed the problem.

[#9]

I'm having this same issue.  this has broken my companies VPN system.  Nothign resolved properly anymore on a fios connection.

[#10 · Accepted solution]

I got a response from Verizon today about this.

"This is expected bahavior.  The Verizon Online DNS resolvers have NXDOMAIN redirection services that redirect any unknown host to a sponsored search page.  You can opt out of this by changing your resolver from .12 to .14."