Website access on Plusnet - can someone do a quick test please

[#1]

Hi
I am having problems accessing my websites - usually being forwarded to ncrac.com, a car hire website in Cyprus.
This does not appear to be a problem with my laptop as have replicated the issue with four different laptops running wired and wireless with three different operating systems.  For weeks I got around the problem by deleting cookies and clearing the windows cache - this is no longer working and I have not had access to my websites at all since Monday morning.  Everyone else can access my websites, including my host friend but I have been unable to find someone else who uses Plusnet as their ISP to test.  My server host friend blames the DNS servers at Plusnet and I am hopng that someone will please test that theory to some extent by trying to access one of my websites.
Please can someone try to access www.itdoctors.co.uk , www.godivafencing.co.uk and/or www.cointrader.co.uk and get back to me with the result.
Thank you       

[#2]

All links forwarded to North Cyprus Rentals ... as you indicated.

[#3]

me too

[#4]

Same here.

[#5]

Hi Richard and others 🙂
Thanks for your assistance.  That does appear to prove that the problem is with Plusnet somewhere.  A dial test was run for a second time last night and as the formerly intermittent website access is now permanent, I hope that the problem will be found quickly.
Thanks again
Rob 

[#6]

No problem accessing all three links - not using Plusnet DNS Servers.
You could try changing your DNS servers to use Open DNS:
208.67.222.222
208.67.220.220
or, alternatively using the Google DNS Servers:
8.8.8.8
8.8.4.4
I tend not to use the Plusnet DNS Servers.
May be worth a try.

[#7]

First two to Cyprus but cointraders OK. Win7 and Firefox4

[#8]

all three failed via PN, so logged on with my 3 MiFi and all three OK  thats in a five minute period

[#9]

Quote from: Ransomefan

First two to Cyprus but cointraders OK

Same for me (IE8 on XP)

[#10]

Quote from: Mr

No problem accessing all three links - not using Plusnet DNS Servers. You could try changing your DNS servers to use Open DNS: 208.67.222.222 208.67.220.220 or, alternatively using the Google DNS Servers: 8.8.8.8 8.8.4.4 I tend not to use the Plusnet DNS Servers. May be worth a try.

Thanks Mr Chips
I tried a hastily looked up proxy DNS server earlier - don't laugh, 'hidemyass'.  This worked so it definitely looks like some undesirable has hacked the Plusnet DNS server and targetted my websites.  Hopefully Plusnet will get back to me later as it appears there may be a security issue here that affects others.
Your advice is a far more professional solution and it works.
Thanks to all - great community spirit !! '

[#11]

Strictly, Plusnet are giving the correct answer - it looks like your DNS records have been hacked (I found those using http://www.dnsstuff.com/tools/whois/?tool_id=66&token=&toolhandler_redirect=0&ip=www.itdoctors.co.uk...

C:\Users\John>nslookup www.itdoctors.co.uk
Server:  cdns01.plus.net
Address:  212.159.6.9
Non-authoritative answer:
Name:    www.itdoctors.co.uk
Address:  83.142.229.122
Aliases:  www.itdoctors.co.uk

C:\Users\John>nslookup www.itdoctors.co.uk 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
Non-authoritative answer:
Name:    clients.bilstone.co.uk
Address:  87.117.205.6
Aliases:  www.itdoctors.co.uk

C:\Users\John>nslookup www.itdoctors.co.uk  ns.hosteurope.com
Server:  ns.hosteurope.com
Address:  212.67.202.2
Name:    www.itdoctors.co.uk
Address:  83.142.229.122
Aliases:  www.itdoctors.co.uk

[#12]

Quote from: rhino666

This worked so it definitely looks like some undesirable has hacked the Plusnet DNS server and targetted my websites.

No, Plusnet are giving the IP addresses returned by the name servers for your domain.
Are hosteurope supposed to be providing the DNS for your domains?

[#13]

Don't know if it's coincidence or not but just out of curiosity I flushed my DNS cache on XP (ipconfig /flushdns in a DOS box). Now all three links take me to Cyprus (tried twice before flushing - and didn't have problem with the cointraders link)

[#14]

Jelv's on the right track here.
The DNS records (when querying the authoritative name servers for the domain) are as follows:

; <<>> DiG 9.3.4-P1.2 <<>> www.itdoctors.co.uk @ns.hosteurope.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9578
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.itdoctors.co.uk.           IN      A
;; ANSWER SECTION:
www.itdoctors.co.uk.    86400   IN      CNAME   clients.bilstone.co.uk.
www.itdoctors.co.uk.    86400   IN      A       83.142.229.122

There's a conflicting CNAME and A record there from what I can tell (which I'd query with your 'server host'). Our DNS servers are returning the results for the A record:

$ dig www.itdoctors.co.uk @212.159.6.10
; <<>> DiG 9.3.4-P1.2 <<>> www.itdoctors.co.uk @212.159.6.10
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11488
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.itdoctors.co.uk.           IN      A
;; ANSWER SECTION:
www.itdoctors.co.uk.    86400   IN      CNAME   clients.bilstone.co.uk.
www.itdoctors.co.uk.    86400   IN      A       83.142.229.122

If you try browing to that IP address at http://83.142.229.122 then you'll understand why your getting the ncrac.com site.
Google's DNS servers return a different IP (the one you want?):

$ dig www.itdoctors.co.uk @8.8.8.8
; <<>> DiG 9.3.4-P1.2 <<>> www.itdoctors.co.uk @8.8.8.8
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42734
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.itdoctors.co.uk.           IN      A
;; ANSWER SECTION:
www.itdoctors.co.uk.    84928   IN      CNAME   clients.bilstone.co.uk.
clients.bilstone.co.uk. 60      IN      A       87.117.205.6

That's either due to domain propagation I'd have thought or differences in our DNS implementations/software.
Google are getting that IP by following the CNAME rather than the A record. You can see that our servers would arrive at the same IP if they were to do the same:

$ dig clients.bilstone.co.uk @212.159.6.10
; <<>> DiG 9.3.4-P1.2 <<>> clients.bilstone.co.uk @212.159.6.10
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37307
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;clients.bilstone.co.uk.                IN      A
;; ANSWER SECTION:
clients.bilstone.co.uk. 60      IN      A       87.117.205.6

So unless I'm mistaken, you need to speak to whoever looks after the DNS for your domain and question why the following A record is present in the zone file?

www.itdoctors.co.uk.    86400   IN      A       83.142.229.122

[#15]

Thanks Jelv and Bob
I have been onto 123.reg who look after the nameserver management side of the websites I run.  The 'Cname' and 'A' records look as expected and there is no 'A' record with that ncrac.com IP address.
Do you have an idea of where this record could have been inserted.
Thanks
Rob