RE: starwars.com subdomain hijacked?

[Matt Disuko <gourmetcisco () hotmail com>]

Yep, that's it.  My nameserver is caching the old advert site that was serving up when the domain expired:

;; ANSWER SECTION:
shop.starwars.com.      1652    IN      CNAME   shop.starwars.novator2.com.
shop.starwars.novator2.com. 1652 IN     A       74.54.152.75

;; AUTHORITY SECTION:
novator2.com.           160198  IN      NS      dns.yourdomainhasexpired.com.
novator2.com.           160198  IN      NS      dns2.yourdomainhasexpired.com.

bloody hell.

-matt


> Subject: Re: starwars.com subdomain hijacked?
> From: wschultz () bsdboy com
> Date: Mon, 22 Nov 2010 08:49:48 -0800
> CC: nanog () nanog org
> To: gourmetcisco () hotmail com
>
> Appears that it's a CNAME for shop.starwars.novator2.com. 
>
> The expiry day is 11/22/2011, so if I were to guess I would think that the domain expired, sent to an advert page, 
> and was just renewed.
>
> -wil
>
>
> On Nov 22, 2010, at 7:46 AM, Matt Disuko wrote:
>
> > It seems the subdomain "shop.starwars.com" is being redirected.
> >
> > Anybody else seeing this?
> >
> >
> >
> >