{"action":"created","issue":{"url":"https://api.github.com/repos/pi-hole/pi-hole/issues/872","repository_url":"https://api.github.com/repos/pi-hole/pi-hole","labels_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/872/labels{/name}","comments_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/872/comments","events_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/872/events","html_url":"https://github.com/pi-hole/pi-hole/issues/872","id":185799354,"number":872,"title":"NX Hijacking","user":{"login":"brontide","id":1634022,"avatar_url":"https://avatars.githubusercontent.com/u/1634022?v=3","gravatar_id":"","url":"https://api.github.com/users/brontide","html_url":"https://github.com/brontide","followers_url":"https://api.github.com/users/brontide/followers","following_url":"https://api.github.com/users/brontide/following{/other_user}","gists_url":"https://api.github.com/users/brontide/gists{/gist_id}","starred_url":"https://api.github.com/users/brontide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brontide/subscriptions","organizations_url":"https://api.github.com/users/brontide/orgs","repos_url":"https://api.github.com/users/brontide/repos","events_url":"https://api.github.com/users/brontide/events{/privacy}","received_events_url":"https://api.github.com/users/brontide/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-27T22:48:55Z","updated_at":"2016-11-16T19:25:10Z","closed_at":null,"body":"_This template was created based on the work of [`udemy-dl`](https://github.com/nishad/udemy-dl/blob/master/LICENSE)._\n\n**In raising this issue, I confirm the following (please check boxes, eg [X]):**\n- [X] I have read and understood the [contributors guide](https://github.com/pi-hole/pi-hole/blob/master/CONTRIBUTING.md).\n- [X] The issue I am reporting can be _replicated_\n- [X] The issue I'm reporting isn't a duplicate (see [FAQs](https://github.com/pi-hole/pi-hole/wiki/FAQs), [closed issues](https://github.com/pi-hole/pi-hole/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aclosed%20), and [open issues](https://github.com/pi-hole/pi-hole/issues)).\n\n**How familiar are you with the codebase?:**\n- [X] 7\n\n---\n\nOnly 2 of the presented upstream DNS servers does not NX hijack connections to mistyped domains.  I recommend we either stop using them or put into place the config changes for dnsmasq to block the replies.  I discovered this the other day during the DDoS when I tried swapping out my usual google DNS for comodo.\n\nI suggest we take advantage of the `bogus-nxdomain` dnsmasq option to properly filter these answers.\n\nGoogle\n- 8.8.8.8, 8.8.4.4\n- No NX redirection\n\nOpenDNS\n- 208.67.222.222, 208.67.220.220\n- No NX redirection\n\nLevel3\n- 4.2.2.1, 4.2.2.2\n- NX Hijacking\n\nNorton\n- 199.85.126.10, 199.85.127.10\n- NX Hijacking\n\nComodo\n- 8.26.56.26, 8.20.247.20\n- NX Hijacking\n\n```\necho Google\ndig @8.8.8.8 www.bogus.nxdomain +short\ndig @8.8.4.4 www.bogus.nxdomain +short\necho OpenDNS\ndig @208.67.222.222 www.bogus.nxdomain +short\ndig @208.67.220.220 www.bogus.nxdomain +short\necho Level3\ndig @4.2.2.1 www.bogus.nxdomain +short\ndig @4.2.2.2 www.bogus.nxdomain +short\necho Norton\ndig @199.85.126.10 www.bogus.nxdomain +short\ndig @199.85.127.10 www.bogus.nxdomain +short\necho Comodo\ndig @8.26.56.26 www.bogus.nxdomain +short\ndig @8.20.247.20 www.bogus.nxdomain +short\n```\n\n```\nGoogle\nOpenDNS\nLevel3\n198.105.254.11\n104.239.213.7\n198.105.254.11\n104.239.213.7\nNorton\n54.200.75.96\n54.200.75.96\nComodo\n92.242.144.50\n92.242.144.50\n```\n"},"comment":{"url":"https://api.github.com/repos/pi-hole/pi-hole/issues/comments/261045437","html_url":"https://github.com/pi-hole/pi-hole/issues/872#issuecomment-261045437","issue_url":"https://api.github.com/repos/pi-hole/pi-hole/issues/872","id":261045437,"user":{"login":"dschaper","id":2782850,"avatar_url":"https://avatars.githubusercontent.com/u/2782850?v=3","gravatar_id":"","url":"https://api.github.com/users/dschaper","html_url":"https://github.com/dschaper","followers_url":"https://api.github.com/users/dschaper/followers","following_url":"https://api.github.com/users/dschaper/following{/other_user}","gists_url":"https://api.github.com/users/dschaper/gists{/gist_id}","starred_url":"https://api.github.com/users/dschaper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dschaper/subscriptions","organizations_url":"https://api.github.com/users/dschaper/orgs","repos_url":"https://api.github.com/users/dschaper/repos","events_url":"https://api.github.com/users/dschaper/events{/privacy}","received_events_url":"https://api.github.com/users/dschaper/received_events","type":"User","site_admin":false},"created_at":"2016-11-16T19:25:10Z","updated_at":"2016-11-16T19:25:10Z","body":"The only thing I would change is swapping OpenDNS for Google on the order. (But same parent company...) Just as stable as Google, same redirection issues."}}
{"actor":{"display_login":"dschaper"}}