Lots of dead Lemmy/Kbin domains have CNAME records pointing to the same domain parking company
Lots of dead Lemmy/Kbin domains have CNAME records pointing to the same domain parking company
publication croisée depuis : https://lemmy.pierre-couy.fr/post/584644
While monitoring my Pi-Hole logs today, I noticed a bunch of queries for
XXXXXX.bodis.com, where XXXXXX are numbers. I saw a few variations for the numbers, each one being queried several times.Digging further, I found out these queries were caused by CNAME records on domains that look like they used to point to Lemmy/Kbin instances.
From what I understand, domain owners can register a CNAME record to
XXXXXX.bodis.comand earn some money from the traffic it receives. I guess that each number variation is a domain owner ID in Bodis' database. I saw between 5 to 10 different number variations, each one being pointed to by a bunch of old Lemmy domains.This probably means that among actors who snatch expired domains, several of them have taken a specific interest with expired domains of old Lemmy instances. Another hypothesis is that there were a lot of domains registered for hosting Lemmy during the Reddit API debacle (about 1 year ago), which started expiring recently.
Are there any other instance admins who noticed the same thing ? Is any of my two hypothesis more plausible than the other ? Should we worry about this trend ?
Anyway, I hope this at least serves as a reminder to not let our domains expire ;)
DNS engineer here, I'm not doing work on a weekend, but I will make you guys aware of digwebinterface.com great tool for running investigations like this
As a DNS engineer - do you own a shirt with the slogan “It’s always DNS.” on it?
It's not DNS until the firewall team cleans house and even then not until you happened to catch me between matches in the videogame I'm playing while waiting for something to break
Thanks for sharing your research
I feel like this could be abused by a bad actor by recreating instances in several ways:Use the "dead" accounts that are still mods on communities on other instances.Sneakily monitor user behavior (like votes etc.) without looking out of place.Impersonate users.
I feel like it would be a good idea to start a list of the domains of dead instances and add them to a blocklist until the original people start using them again.EDIT: This doesn't seem like a real problem due to key signing.
This is just the domain name, not the instance itself. If the instance is offline the moderator accounts will be inaccessible even if the domain name is sold.
Out of interest, is pathfinder.social among those snatched up by these?
It does not seem to be the case. Was it the full domain for this instance ?
According to this service, that domain never had any subdomains, so looks like there's just nothing there at the moment.
Not sure how reliable it is, but it did correctly identify all of my own subdomains for a website that no one ever goes to.
Yes, that's the full domain. It used to host communities such as !pf2general@pathfinder.social. Unfortunately it's been dead for 9–10 months now.