Scam dns hijack

[stender]

One of my companies sites appears to of been hijacked? the site is pointing at a parking page instead of the website.
If I do a whois I see valid details and the two valid nameservers listed.

however if I then goto dnsstuff.com and do a lookup I see an entry for another nameserver ns6 PLEASEDROPTHISHOST20174.XXXXXXXX.net

any ideas whats going on and how to resolve?

 

[retired_member32]

yes you and me both.....

 

[GreyWing]

What registrars you both use?

 

[retired_member32]

i'm with 123 reg

 

[stender]

easyspace. I've just gone in and changed the nameservers, so waiting for them to update. Theres 100's on the login and only 1 affected so it doesn't look like the account has been compromised.

 

[retired_member32]

i had someone enter my registrar account yesterday change my domain tsi.co.uk to nameservers demon.net and it was redirected to tsibroadcast.com for most of yesterday.....

i was waiting on the phone for two hours yesterday with 123 customer service.....i got through at 6.50pm last night and got it sorted.....i did send an urgent support ticket about midday but no reply....

 

[namealot]

Theres a bit about dns afew years ago and a recent 31 aug 2010 question and 1st september reply on 123 reg site but not a great deal ? not sure if it solves or answers you question...?


http://inside.123-reg.co.uk/archives/problems-with-123-reg-this-weekend#comment-5515

 

[retired_member32]

now i have to appoligise for being hacked...i love this Country (money talks heh)