Oh No They Didn't! in Earthlink DSL

Re: Oh No They Didn't!

Sat, 25 Nov 2006 12:49:20 EDT

said by justin :

This nasty feature has arrived on my earthlink cable connection as well.

I'm not even an Earthlink Internet subscriber and now I'm seeing this message. I have Time Warner Cable's Road Runner Lite. I'm waiting on a support callback from Time Warner right now.

Be warned, Earthlink is apparently controlling Road Runners DNS in some areas. I'm going to check out the OpenDNS next. This week I attempted to remotely login to my company's network using the Safenet Remote software they setup. It connected, but I couldn't establish a terminal server connection. Do you suppose this was the reason? I was going to ask our IT guys when I get back on Monday.

Bonjour broken by these shenanigans

Tue, 07 Nov 2006 10:55:06 EDT

riturno : Zero Configuration Networking, (Apple's implementation is known as Bonjour), is broken by this change in Earthlink Services.

»docs.info.apple.com/article.html···m=304689

»www.macintouch.com/#tips.2006.11.07

In order to solve the problem, you have to use the unsupported DNS servers.

This just further points out the harmful and insidious nature of these changes by Earthlink.

Re: Oh No They Didn't!

Mon, 06 Nov 2006 15:55:41 EDT

anon : The main problem with this idiocy, aside from its strictly technical effects, is that the mechanism for correcting the problem relies on proficient "pull" communications. With systems that "just work," like DNS, there's not much literacy required of users, and the transparency of the technology means we end up with a lot of illiterates -- such as the "panties in a bunch" fellow above. How do you know where to begin looking for a problem? The man in charge said, in the EL blog, that the tech support people wouldn't know a damn thing about this if they were called. OK, so the only people whose intuition will lead them to learn of the problem and its fix, are literate people.

How is this any different than state-sponsored lotteries that tax people who are ignorant of statistics and whose economic situation engenders desperation that clutches at such straws? In EL's case, the message is "if you're naive, we'll see to it that our help desk can't help you escape from where we want your eyeballs landing when you can't type."

I figure I'll be leaving EL in coming weeks myself. I don't care if they've been reliable or not -- it's not worth supporting such idiot companies.

That's it, I'm quitting Earthlink...

Fri, 03 Nov 2006 20:57:23 EDT

Gnarlodious : This latest stunt is not only inethical but probably illegal.

Re: Oh No They Didn't!

Mon, 16 Oct 2006 14:11:56 EDT

Archivis : Haha. I decided to let the default DNS do its job. I've never had a problem, so I never even bothered to change them.
--
I melt faces.

Re: Oh No They Didn't!

Mon, 16 Oct 2006 14:02:37 EDT

Doctor Olds :

said by Archivis :

I just got one of their errors a couple days ago. That was especially odd, considering that I haven't used Earthlink's service in years and I haven't worked for them since March of 04.

Then I remembered that I hardcoded their DNS in my connection over three years ago. Hah!

I'd guess you quickly hardcoded a new pair of DNS IPs, correct?

--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Mon, 16 Oct 2006 12:46:38 EDT

Archivis : I just got one of their errors a couple days ago. That was especially odd, considering that I haven't used Earthlink's service in years and I haven't worked for them since March of 04.

Then I remembered that I hardcoded their DNS in my connection over three years ago. Hah!
--
I melt faces.

Re: "Opt Out" DNS Servers

Fri, 13 Oct 2006 06:33:00 EDT

anon : »kb.earthlink.net/case.asp?article=187117

Re: Oh No They Didn't!

Sat, 07 Oct 2006 00:57:24 EDT

PASeattle : Yes, Doctor Olds, I realize that. Under the circumstances, it seems like a reasonable workaround...it's usually easy enough to plug the alternative DNS servers into a router...

Not perfect, but it works...

Re: Oh No They Didn't!

Fri, 06 Oct 2006 04:54:55 EDT

Doctor Olds : They did not roll the changes out system wide overnight. They have just added the EL Cable users recently and are adding systems as they decide (private timetable).

However, if you are hard coding the Covad DNS yourself, it will not affect you since Earthlink does not control Covad DNS, but that's been mentioned already.

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Fri, 06 Oct 2006 04:07:16 EDT

PASeattle : I've been using the Covad Seattle DNS Servers as my primary and secondary servers for a couple of months now. I have not seen any of these issues with dead or incorrectly typed urls nor have I had any problems in making VPN connections between my office and my clients...

Re: Oh No They Didn't!

Thu, 05 Oct 2006 20:21:25 EDT

aj004 : Yes I am aware of that. The problem wasn't the bundle or the price. The problem was the DNS issue that is being talked about here and is something I do NOT WANT. Therefore I am waiting for a reseller which uses their own dns servers.

Re: Oh No They Didn't!

Thu, 05 Oct 2006 20:01:04 EDT

Doctor Olds :

said by aj004 :

I was going to sign up for Earthlink 8MBPS/1MBPS DSL but then saw these posts. I am glad I didn't sign up for such.

Wish another reseller of covad was selling the 8/1 Service :-(

The 8/1 ADSL2+ Service is only available in a Bundle anyway as it is not sold as a stand alone product at this time.

EarthLink® DSL and Home Phone Service bundle (aka Line Powered Voice or LPV)
»www.earthlink.net/voice/bundles/···mephone/

»www.earthlink.net/voice/bundles/···/faq/#10

quote:
Can I just order your super-fast DSL without the home phone service?

At this time, our super-fast DSL service and home phone service are sold together as a bundle. Of course, if you're not interested in home phone service at this time, we do offer DSL and cable Internet connections at very fast speeds!

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Thu, 05 Oct 2006 10:10:59 EDT

aj004 : I was going to sign up for Earthlink 8MBPS/1MBPS DSL but then saw these posts. I am glad I didn't sign up for such.

Wish another reseller of covad was selling the 8/1 Service :-(

Re: Oh No They Didn't!

Wed, 04 Oct 2006 15:24:45 EDT

golden eagle : It sucks ... period!

Re: Oh No They Didn't!

Tue, 03 Oct 2006 11:01:17 EDT

justin : This nasty feature has arrived on my earthlink cable connection as well.

Re: Oh No They Didn't!

Wed, 27 Sep 2006 19:35:13 EDT

anon : Here is what the geeks have to say about this. Good stuff!

»slashdot.org/article.pl?sid=06/0···1&tid=95

Re: Oh No They Didn't!

Tue, 26 Sep 2006 11:54:29 EDT

Doctor Olds :

said by windsurf1970 :

What a joke. I too spent days trying to figure out what was going on with "my" laptop and "my" VPN connection. I even went as far as rebuilding my system thinking I was hijacked. A "dead domain" to Earthlink does NOT equal a dead domain on my company's intranet but Earthlink makes it so by redirecting you to their own earthlink-help.net site. Needless to say, my email and internal chat was not working either, leaving me dead in the water.

[snip]

Bottom line is if I cannot get into my work's network TODAY and Earthlink cannot resolve this with more than a bandaid after I've already wasted 2 weeks fighting the problem, then it's bye-bye Earthlink, hello RoadRunner. I lose nothing; they lose another customer they've had for 5 years.

They have already answered/resolved this all they are willing to and told us literate/educated paying customers (they call us geeks) and anyone that needs RFC compliant DNS to go ahead and screw off as they are in it for the money that Barefruit has promised to pay them. :[ :mad:

Here's where they told us to screw off.

»blogs.earthlink.net/2006/09/more···andl.php

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Tue, 26 Sep 2006 10:06:39 EDT

anon : What a joke. I too spent days trying to figure out what was going on with "my" laptop and "my" VPN connection. I even went as far as rebuilding my system thinking I was hijacked. A "dead domain" to Earthlink does NOT equal a dead domain on my company's intranet but Earthlink makes it so by redirecting you to their own earthlink-help.net site. Needless to say, my email and internal chat was not working either, leaving me dead in the water.
I was given their 207.69.188.171/172 DNS settings during a chat with one of their CSR's, but this does not help if my laptop has a security GPO preventing any changes to DNS settings from sticking for more than an hour. I was also told that their engineers are working on the problem and it will be resolved ASAP, but I was not given any info indicating ASAP means hours, days, or even weeks. If Earthlink's so-called network engineers can't figure this out in a day or two, then they obviously don't know what the hell they're doing. Maybe management will figure out that a paper certification does not equate real world experience and knowledge when they fire these guys and hire new ones.
Bottom line is if I cannot get into my work's network TODAY and Earthlink cannot resolve this with more than a bandaid after I've already wasted 2 weeks fighting the problem, then it's bye-bye Earthlink, hello RoadRunner. I lose nothing; they lose another customer they've had for 5 years.

Re: Oh No They Didn't!

Sun, 24 Sep 2006 18:52:22 EDT

Doctor Olds :

said by NGOwner :

My understanding of this issue:

I make a mistake, and enter in a webaddress that doesn't exist. Earthlink serves up a page (examples on page one) stating that the webaddress I entered doesn't exist. That page includes a few suggestions, respellings, and ads.

Enlighten me here. What's the problem with this?

[NG]Owner

It breaks ping, reverse lookups and traceroute.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Sun, 24 Sep 2006 18:48:38 EDT

astrocity20 : I wouldn't mind it if it was better than google's "I feel lucky" when I type in a keyword for a website. But it isn't so I'm pissed.

Re: Oh No They Didn't!

Mon, 18 Sep 2006 14:54:08 EDT

brambling : I wouldn't mind it if the redirect page didn't look so cheap, and you could opt-out from the "My Account" page. I would feel better if the default account setting blocked the phishing sites, at least the ELN ones, so if I was away from home and wanted a family member to handle the billing, it might catch it.

Re: Oh No They Didn't!

Mon, 18 Sep 2006 14:27:12 EDT

NGOwner : Never mind. I just read some of the earthlink blog above.

Can't say that I agree with you guys.

But since many feel so passionate about it, maybe separate DNS servers for those with their panties in a bunch is the way Earthlink should go.

[NG]Owner
--
It is impossible to create an idiot-proof product. Humanity is simply too adept at churning out better idiots.

Re: Oh No They Didn't!

Mon, 18 Sep 2006 14:09:33 EDT

NGOwner : My understanding of this issue:

I make a mistake, and enter in a webaddress that doesn't exist. Earthlink serves up a page (examples on page one) stating that the webaddress I entered doesn't exist. That page includes a few suggestions, respellings, and ads.

Enlighten me here. What's the problem with this?

[NG]Owner
--
It is impossible to create an idiot-proof product. Humanity is simply too adept at churning out better idiots.

Re: Oh No They Didn't!

Sun, 17 Sep 2006 01:34:06 EDT

Bill_MI : Great find! These did not have their rDNS back when I found the 207.69.188.100-103 servers.

207.69.188.171 optns1.earthlink.net
207.69.188.172 optns2.earthlink.net

Performance here is so-so.

BTW, this is routing within a class C subnet I didn't expect to see. These adjacent addresses ARE Pasadena and Atlanta. :-)

Re: Oh No They Didn't!

Sun, 17 Sep 2006 01:01:07 EDT

anon : EarthLink DNS servers without the redirection..

»blogs.earthlink.net/2006/09/more···andl.php

207.69.188.171 (west coast)

207.69.188.172 (east coast)

If you're west of the Mississippi, use the west coast DNS server as your primary and the east coast as secondary. And vice-versa for those of you in the eastern U.S.

Cancelling my service right now.

Tue, 12 Sep 2006 12:46:48 EDT

coolhaus : This is technically unacceptable, and a slimy revenue grab. Cancelling my Earthlink service right now and reverting to Time-Warner cable.

I was a subscriber for eight years, by the way. To say I am a little pissed is an understatement.

Re: Oh No They Didn't!

Mon, 11 Sep 2006 21:29:37 EDT

anon : This is Earthlink's complaint form where you can submit your feedback on the subject: »support.earthlink.net/feedback/myearthlink/

Also, here's a PledgeBank pledge that's trying to get them to stop the DNS redirect service: »www.pledgebank.com/earthlinksucks

Re: Something fishy

Mon, 11 Sep 2006 21:00:33 EDT

anon : Everytime I start a program--Outlook, Any graphic editor, MS Word etc. My firewall alerts me that "System" is trying to connect to the barefruit IP. This is how trojans work.

Re: Oh No They Didn't!

Tue, 05 Sep 2006 22:35:23 EDT

Windsun : I would really mind it if they would make it optional.

Re: Oh No They Didn't!

Tue, 05 Sep 2006 00:19:19 EDT

anon : I am just speculating but I think their target market is the part of the population that are not net savvy. They are trying to prevent misdirects due to typing errors and are also trying to prevent phishing. Think about the non technical people that ask you what they can do to prevent or reduce phishing. You could just plug in the opendns IP numbers and know that the number of typo scams and phishing scams would be reduced. In return for using their dns servers they put up a few ads, but only when you have a typo or they feel it might be a phishing scam. And they are up front about it too. I am currently on pppoe with dynamic IP and I have been using them for over a month. I think their "oops" page popped up once or twice because I mistyped a URL. You might not like ads (as do I) but consider the alternative for your friends (or their kids) when they mistype a URL.

As I said previously, plug in their dns IP numbers and try them out for a few days or a week or so. If you don't like what you see you can easily restore your original dns settings.

Cheers

Re: Oh No They Didn't!

Mon, 04 Sep 2006 20:07:36 EDT

Bill_MI :

said by longtimelurker :

Bill, did you look at this page?

»www.opendns.com/prefs/

It allows you to turn off all of that stuff and have a "plain vanilla" DNS server.

Cheers

OpenDNS is becoming more and more interesting. They're obviously on a goal to make a dent in the sorry state of a LOT of ISP's DNS.

Now, here's settings that goes against their business model. I'm rather cynical about "something-for-nothing" services and been wondering what lies beneath their system.

I suspect they're about to create a new term: "DNS data mining". By itself, it may have very little privacy concern for users. But when combined with other data, probably becomes just another piece to narrow down the marketing interests.

I'm purely speculating but history says there's usually more than meets the eye. I'm curious what others are thinking about OpenDNS? Doesn't the concept seem a little strong for their stated business model? (Which is: "you goof, you get an ad" :-) )

Don't get me wrong, their servers seem robust and speedy. *Everything* I've ever looked up is cached so the response time is almost a constant and I suspect they constantly and actively refresh their DNS cache just for this purpose (rather than wait for someone to ask for a domain name). This concept is interesting all by itself.

Re: Oh No They Didn't!

Mon, 04 Sep 2006 18:52:58 EDT

Doctor Olds :

said by longtimelurker :

»www.opendns.com/prefs/

It allows you to turn off all of that stuff and have a "plain vanilla" DNS server.

quote:
These preferences are intended for those with static IP addresses.

Earthlink uses Dynamic IPs on their DSL service.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Mon, 04 Sep 2006 18:10:38 EDT

anon : Bill, did you look at this page?

»www.opendns.com/prefs/

It allows you to turn off all of that stuff and have a "plain vanilla" DNS server.

Cheers

Re: Oh No They Didn't!

Fri, 01 Sep 2006 00:31:34 EDT

Bill_MI :

said by longtimelurker :

If you want to change to an alternative DNS server you might want to check out:
»www.opendns.com/

When this service was first mentioned a while back, I did some checking and it was the epitome of the practice Earthlink is now slithering into.

Unfortunately, I view this venture as a sad indicator of Earthlink's business position. :huh:

Re: Oh No They Didn't!

Thu, 31 Aug 2006 22:43:41 EDT

anon : If you want to change to an alternative DNS server you might want to check out:

»www.opendns.com/

I think they got a mention on this site a few months ago when they started up operations. I have been using them for about a month or so and have not had any problems. Others on this site have used them with positive results as well. If you don't like how they work you can just revert back to what you are using now. I only costs a little time to try them out, nothing more...

If you only need their DNS IP numbers, they are:
208.67.222.222
208.67.220.220

Just a happy customer (and did I mention its free?) :-)

Cheers

Re: Oh No They Didn't!

Thu, 31 Aug 2006 17:58:07 EDT

Doctor Olds : So is that the Official Channel for System Wide changes?

I love this part....They don't know how it works or they just believed the lies their partners told them....

»blogs.earthlink.net/2006/08/hand···ns_1.php

quote:
Our partners on the product are Yahoo and Barefruit, a company that specializes in processing DNS and HTTP errors for ISPs. Barefruit provides the system to process errors and Yahoo hosts the destination customers are directed to. For more than a year we have been offering DNS error functionality for EarthLink Toolbar users through our Yahoo relationship, and Barefruit provides the technology that allows us to extend this functionality to EarthLink’s entire access customer base.

So far, we've rolled out the system to a small number of servers, and ISP geeks who track of this sort of thing noticed pretty quickly. The service has been criticized in some online conversations because by nature it changes the way DNS errors are reported through the network. It’s important to remember that the Barefruit system only processes errors classified as NXDOMAIN (non-existent domain) when they are in route back to a user’s browser, which means the user experience we are changing is a browser error stating the web site cannot be found or the auto-search functionality of Internet Explorer, neither of which are especially helpful to the user. The system is specifically configured to handle only NXDOMAIN HTTP traffic as it is being returned to the user’s browser and to not impact email and other non-web-browsing traffic.

If it only routes this change to my Browser, how come my other affected programs like Ping, Tracert, Email to name a few are being involved? The person in charge doesn't know what DNS does? :[

Speaking of the guy in charge, it is a guy named Ken Womack.

quote:
I should note that I'm the EarthLink product manager for this initiative on the customer-facing end (the results page users see).

Posted by: Ken Womack | August 30, 2006 02:28 PM

I love it when they put people in charge of things they don't understand. NOT :[

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Thu, 31 Aug 2006 01:59:23 EDT

whfsdude : »blogs.earthlink.net/2006/08/hand···ns_1.php

I think tmrw I'm going to bitch in the comments

Re: Oh No They Didn't!

Wed, 30 Aug 2006 15:41:52 EDT

about_blank :

said by Dr. Strange :
'127.0.0.1 elydm.01.am.barefruit.com' into the hosts file. It redirects requests to elydm.01.am.barefruit.com to 127.0.0.1 [the localhost address].

Thanks for the edification. I'm assuming that any direct request to an actual IP address (number) does not have to use the hosts file to look anything up. Since that is my situation, I'm filtering the outgoing requests using my firewall, which alerts me with a pop-up at each attempt.

I've noted that these attempts continue for a couple of hours, then stop. But the following day, an attempt is made to contact one of the other addresses for barefruit.com, which my firewall catches. I then add the new address to the firewall, set to pop-up a small box each time an attempt is made. Right now, I've added 209.86.66.90 through 209.86.66.95, corresponding to elydm.01.am.barefruit.com through elydm.06.am.barefruit.com, inclusive. (Just to get ahead of the game - So far, only elydm.01, 03, and 06 have been used, but I've added 02, 04 and 05.)

Thanks again!

Re: Oh No They Didn't!

Tue, 29 Aug 2006 10:59:21 EDT

DrStrange : You should have entered

'127.0.0.1 elydm.01.am.barefruit.com' into the hosts file. It redirects requests to elydm.01.am.barefruit.com to 127.0.0.1 [the localhost address].

209.86.66.90 is what goes into the firewall with the 'deny all' rule.

If you enter the actual IP address into the hosts file, it just means that requests for the associated domain go directly to that address instead of querying a DNS server first [that's how the hosts file was originally intended to be used].

Re: Oh No They Didn't!

Mon, 28 Aug 2006 11:59:04 EDT

about_blank :

said by DrStrange :
If anything redirects to barefruit by name, it's blocked now. When I get some time, I'll blackhole those six IPs as well. That should take care of that.

I'm familiar with the hosts file, but am not sure exactly what effect entries have. For instance, if I put the following line in the hosts file:

209.86.66.90 elydm.01.am.barefruit.com

does that block any outgoing requests to 209.86.66.90? Or merely identify that outgoing request as "elydm.01.am.barefruit.com" in various log files, instead of using the 209.86.66.90 address?

If it blocks requests to 209.86.66.90, what advantage is there in using the hosts file, rather than my firewall, to block these requests?

I hope you can enlighten me - thanks in advance!

PS: I rolled back using GoBack, which eliminated the outgoing requests to 209.86.66.92, but within 24 hours, I've now got a request to 209.86.66.95! (I'm currently blocking that request with my firewall, but my machine is attempting to contact that site every 15 minutes like clockwork.)

Re: Covad DNS Servers

Sun, 27 Aug 2006 21:52:54 EDT

Bill_MI : When I get a chance, I'll run DNSRU on each, it's been awhile.

$ traceroute -I 4.2.2.1
traceroute to 4.2.2.1 (4.2.2.1), 30 hops max, 40 byte packets
 1  h-69-3-125-1.sfldmidn.dynamic.covad.net (69.3.125.1)  19.468 ms  18.758 ms  18.223 ms
 2  192.168.7.137 (192.168.7.137)  18.784 ms  17.186 ms  18.224 ms
 3  ge-5-1-133.hsa2.Detroit1.Level3.net (166.90.203.1)  19.169 ms  17.359 ms  16.907 ms
 4  so-0-3-0.mp1.Detroit1.Level3.net (4.68.97.217)  18.742 ms  18.039 ms  19.195 ms
 5  so-2-0-2.bbr2.Chicago1.Level3.net (64.159.0.194)  22.484 ms ae-0-0.bbr1.Chicago1.Level3.net (64.159.1.33)  20.969 ms  23.312 ms
 6  ge-11-2.core1.Chicago1.Level3.net (4.68.101.164)  24.863 ms ge-11-0.core1.Chicago1.Level3.net (4.68.101.36)  32.006 ms ge-10-2.core1.Chicago1.Level3.net (4.68.101.132)  37.387 ms
 7  vnsc-pri.sys.gtei.net (4.2.2.1)  43.426 ms  35.718 ms  30.637 ms
 
$ traceroute -I 64.105.179.138
traceroute to 64.105.179.138 (64.105.179.138), 30 hops max, 40 byte packets
 1  h-69-3-125-1.sfldmidn.dynamic.covad.net (69.3.125.1)  17.606 ms  18.532 ms  18.720 ms
 2  192.168.7.137 (192.168.7.137)  19.612 ms  19.595 ms  20.453 ms
 3  h-64-105-179-138.sfldmidn.covad.net (64.105.179.138)  20.243 ms  17.518 ms  20.342 ms

You can see why Covad could be an ideal solution.

EDIT: Boy, tracert resolution sure sucks in Win2K, I switched to Linux - now the route changes show. Sheesh

Re: Covad DNS Servers

Sun, 27 Aug 2006 19:39:30 EDT

Doctor Olds : How many hops are you from these?

4.2.2.1 and 4.2.2.2 ?

19:33:59  Sun 08-27-2006
C:\WINDOWS>tracert 4.2.2.1
 
Tracing route to vnsc-pri.sys.gtei.net [4.2.2.1]
over a maximum of 30 hops:
 
  1     1 ms     1 ms     1 ms  192.168.254.254
  2    15 ms    14 ms    13 ms  172.31.255.251
  3    13 ms    12 ms    12 ms  192.168.1.57
  4    14 ms    13 ms    12 ms  ge-6-5.car2.Atlanta1.Level3.net [63.209.220.93]
  5    14 ms    12 ms    11 ms  ge-10-2.hsa1.Atlanta1.Level3.net [4.68.103.132]
  6    14 ms    13 ms    13 ms  vnsc-pri.sys.gtei.net [4.2.2.1]
 
Trace complete.
 
19:36:20  Sun 08-27-2006
C:\WINDOWS>tracert 4.2.2.2
 
Tracing route to vnsc-bak.sys.gtei.net [4.2.2.2]
over a maximum of 30 hops:
 
  1     1 ms   <10 ms     1 ms  192.168.254.254
  2    14 ms    13 ms    14 ms  172.31.255.251
  3    14 ms    12 ms    11 ms  192.168.1.57
  4    13 ms    12 ms    13 ms  ge-6-5.car2.Atlanta1.Level3.net [63.209.220.93]
  5    14 ms    10 ms    12 ms  ge-11-1.hsa1.Atlanta1.Level3.net [4.68.103.100]
  6    15 ms    13 ms    13 ms  vnsc-bak.sys.gtei.net [4.2.2.2]
 
Trace complete.

Regards,

Doctor Olds

--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Covad DNS Servers

Sun, 27 Aug 2006 19:15:00 EDT

Bill_MI : In case it helps anyone: »www.covad.com/onlinesupportcente···ns.shtml

I found Covad DNS to not be the best in Detroit and Chicago - maybe others aren't as bad. If you're on Covad, they are usually very close by. I tested several non-existent domains and see no sign of the Earthlink skulduggery.

Re: Oh No They Didn't!

Sun, 27 Aug 2006 17:24:13 EDT

Doctor Olds : The best solution (until Earthlink stops this crap) is to set your Router DHCP server settings for these two IPs.

4.2.2.1 and 4.2.2.2

If you have a UHP Modem they go here in the setup.

»EarthLink DSL FAQ »How to Specify DNS Information in the EarthLink UHP ADSL Modem

In the newer P660R-ELNK it is on this page under "Advanced Setup" then select "LAN", type in the Primary and Secondary DNS servers (4.2.2.1 for Primary and 4.2.2.2 for Secondary) then click on Apply.

»/r0/download/1···etup.JPG

Other Routers and Router/Modems that have built in PPPoE should have similar fields.

To get your Pc[s] to use the new info, release and renew your IP address in your OS.

In XP/Win2K open a CMD box and type "ipconfig /release" then count to 10 then type in "ipconfig /renew"

In Win9x and WinME open a Command box and type "winipcfg /all" and a GUI will open up. In the Box select your Ethernet Adapter from the dropdown menu, then click the release button then count to 10, press the renew button to get fresh info from the Router.

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Sun, 27 Aug 2006 12:52:17 EDT

DrStrange : If anything redirects to barefruit by name, it's blocked now. When I get some time, I'll blackhole those six IPs as well. That should take care of that.

Re: Oh No They Didn't!

Sun, 27 Aug 2006 02:18:35 EDT

Doctor Olds :

said by DrStrange :

I'm watching the progress of this and just created a little redirect of my own. I stuck barefruit in my hosts file. When I get a minute, I'll blackhole their IP range in my firewall.

This will backfire on EL big-time.

209.86.66.90 elydm.01.am.barefruit.com
209.86.66.91 elydm.02.am.barefruit.com
209.86.66.92 elydm.03.am.barefruit.com
209.86.66.93 elydm.04.am.barefruit.com
209.86.66.94 elydm.05.am.barefruit.com
209.86.66.95 elydm.06.am.barefruit.com

Those IP above are on EL IP space.

quote:
IP block 209.86.66.90
Trying 209.86.66.90 at ARIN
Trying 209.86.66 at ARIN

OrgName: EarthLink, Inc.
OrgID: ERMS
Address: 1375 PEACHTREE ST, LEVEL A
City: ATLANTA
StateProv: GA
PostalCode: 30309
Country: US

NetRange: 209.86.0.0 - 209.86.255.255
CIDR: 209.86.0.0/16
NetName: EARTHLINK2000-E
NetHandle: NET-209-86-0-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: ITCHY.MINDSPRING.NET
NameServer: SCRATCHY.MINDSPRING.NET
Comment:
RegDate: 2000-04-20
Updated: 2000-04-20

What about those? :[
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Sun, 27 Aug 2006 01:16:03 EDT

DrStrange : I'm watching the progress of this and just created a little redirect of my own. I stuck barefruit in my hosts file. When I get a minute, I'll blackhole their IP range in my firewall.

This will backfire on EL big-time.

Re: Oh No They Didn't!

Sat, 26 Aug 2006 20:24:07 EDT

about_blank : Many thanks to ChemDude2 and to Bill in Michigan for your replies!

My issue with the outgoing request to elydm.03.am.barefruit.com [209.86.66.92] is unresolved. Earthlink suggests using their 'verify a website' box on their home page, and I was not surprised to find that no matter what variant of the above address I typed, their verification engine denied having anything to do with the web address in question. This may be so, I just don't know.

I've examined my GoBack logs for the past few days to see what changes might have triggered this annoyance, but have come up empty handed. I may just revert to a GoBack restore point prior to the annoyance, as my firewall pops up a warning every 15 minutes, like clockwork, that some process is seeking to contact barefruit.com. Not sure if it's related to the actual topic of this thread, but there are so few hits when I google 'barefruit.com' that it seemed appropriate to leave this info here. I won't belabor the point any more.

Thanks again for your help!

Re: Oh No They Didn't!

Sat, 26 Aug 2006 14:55:06 EDT

ChemDude2 : Ok, if you want to change your DNS servers that your computer is using, it's very simple. Amazingly, Earthlink has how-to's for you to follow.

For Windows 2000 or XP
»www.earthnet.net/support/tcpip_d···K-xp.htm

For Windows 95, 98, or ME
»www.earthnet.net/support/tcpip_d···5-Me.htm

For Apple OSX
»www.earthnet.net/support/tcpip_d···_osx.htm

For Apple OS 9
»www.earthnet.net/support/tcpip_d···_os9.htm

And finally, if you're using any form of Unix, Linux, or BSD you already know how to do this so I won't even say.

Good luck.

Re: Oh No They Didn't!

Sat, 26 Aug 2006 08:45:10 EDT

Bill_MI : Remember what this is - returning barefruit.com instead of "non-existent domain" when an address is looked up.

In other words, anything checking for addresses could, potentially, get the barefruit.com address. Even Windows, AVG, AdAware and SpywareDoctor autoupdates or similar. Not that these things ask for bad names but any burp in their DNS providers and something like an AVG *could* be getting barefruit.com.

That's why this practice is so loathsome. :mad:

BTW, from your earlier post, DNS servers can be set in any PC in the network settings. I don't use DHCP (getting settings automatically) but the source of these settings (like routers and modems) varies from configurable to can't-do-it. Finding good DNS servers is more the issue.

One thing for sure, DNS servers returning anything other than address failures are put on my sh*tlist so fast and their nature publicly condemned. I switched to no forwarding DNS servers for now (I run my own DNS). I'm delighted to see others feel the same.

Re: Oh No They Didn't!

Sat, 26 Aug 2006 07:49:26 EDT

about_blank : Here's a disturbing occurrence that I hope someone can shed some light on:

Last night, while booting my Win XP machine, I received a firewall pop-up notification (before I had logged on, no less) that some "system" process was trying to contact "elydm.03.am.barefruit.com [209.86.66.92]". I had never seen this notification before, so suspected spyware.

I denied permission, logged on, and immediately ran three scans of my hard drives: one with AVG Free anti-virus, one with Ad-Aware SE Personal, and one with Spyware Doctor (each having been updated to use their latest data files). Each scan came back negative.

Meanwhile, I noticed that my firewall (Kerio Personal) kept popping up a periodic warning that "system" was trying to contact the above mentioned "elydm.03.am.barefruit.com [209.86.66.92]", and each time I denied permission. Finally, I went into the "guts" of Kerio to investigate, and noted that the program sending the request was only identified as "system" - not too much help there. So, I went into Kerio's "Packet Filter..." screen and configured a blanket denial of access to the address mentioned, but set a notification to appear each time the denial was issued.

Then, I started googling for barefruit.com and 209.86.66.92, and came across some of the same information noted in earlier posts on this topic in this forum.

It is not clear to me what is happening, but I suspect that Earthlink (my ISP) has somehow configured my machine to "phone home" to barefruit.com - and from my Kerio pop-up settings, I can see that it is attempting to do so every 15 minutes, consistently. I am puzzled why this behavior has not been identified by Spyware Doctor, nor by Ad-Aware SE Personal, as spyware.

As I have used my firewall to block this outgoing communication, I cannot verify that Earthlink is using barefruit.com to redirect my "not found" pages to ones provided by barefruit.com - I still get my 'normal' browser 'not found' warning. (I use Netscape 7.2 for my browser.)

If anyone can provide some insight as to what is going on here - and hopefully, how to deactivate the program or process that is attempting to 'phone home' to barefruit.com, I would be most appreciative!

Re: Oh No They Didn't!

Sat, 26 Aug 2006 07:26:12 EDT

about_blank :

said by ChemDude2 :
Forget Earthlink! Use public DNS servers and never rely on them again.

I'm not sure how one uses a "public DNS server" - isn't the DNS server "provided" automatically? How does one select ones own DNS server? (Please pardon my ignorance on this matter.)

Re: Oh No They Didn't!

Fri, 25 Aug 2006 18:35:11 EDT

ChemDude2 : Forget Earthlink! Use public DNS servers and never rely on them again.

Just my two cents.

Re: Nevermind... I see it now

Thu, 24 Aug 2006 22:21:08 EDT

Bill_MI : Yes, timing seems to be everything and this almost looks like some kind of kloodge in Earthlink's DNS. When the redirects respond it's always delayed slightly while a failure to find the domain is very quick.

I happen to be playing with VMWare running a Ubuntu appliance and nslookup must give up very quickly because I cannot get those IPs noway nohow. On my Win2K box it's easy but no 50% anymore... more like 10% does it get the redirected IPs.

EDIT: I run:
nslookup fhyudsghedghdv.com 207.69.188.186
...over and over and eventually get the 209.86.66.9x addresses in between several "Non-existent domain" responses.

Re: Nevermind... I see it now

Thu, 24 Aug 2006 21:07:13 EDT

whfsdude :

said by Bill_MI :

AHA!My usual BIND-NT server, even when using ns2.mindspring.com as a forwarder, refuses to show this even when trying random jibberish domains. Not sure this means anything, just a curiosity. :-)

I think if you set your DNS timeout low it wpn't show. I know it doesn't show all the time in Safari because of that. However, in Camino (Firefox engine over cool cooca app interface goodness) it shows all the time. Unless you get so pissed off you change the DNS servers on your router ;)

Nevermind... I see it now

Thu, 24 Aug 2006 20:15:52 EDT

Bill_MI : AHA! Only Windows queries get occasional redirects!

I have to set my box to use ns2.mindspring.com and about 50% of nslookups for the SAME MALFORMED DOMAIN gets the 209.86.66.9x addresses returned. Hmmm... at least I know I'm not nutso.

My usual BIND-NT server, even when using ns2.mindspring.com as a forwarder, refuses to show this even when trying random jibberish domains. Not sure this means anything, just a curiosity. :-)

Re: Oh No They Didn't!

Thu, 24 Aug 2006 18:32:55 EDT

riturno : Saw the redirect this morning and thought it was a fluke. I still see some proper response to a failed query.

This is very unpleasant and I am disappointed.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 17:12:50 EDT

Doctor Olds : They are using bearfruit.com / barefruit.co.uk to do this. Looks to be UK based.

»barefruit.com/?page=home

The IPs EL has setup to redirect when DNS fails:

209.86.66.90 elydm.01.am.barefruit.com
209.86.66.91 elydm.02.am.barefruit.com
209.86.66.92 elydm.03.am.barefruit.com
209.86.66.93 elydm.04.am.barefruit.com
209.86.66.94 elydm.05.am.barefruit.com
209.86.66.95 elydm.06.am.barefruit.com

Go watch the Flash Intro at bearfruit to see what they do.
»www.barefruit.com/?page=home

Q&A
»www.barefruit.com/?page=Q+%26+A

»www.bluecoat.com/solutions/sp/internet.html

quote:
ISPs can also provide revenue from the errors that users produce. By redirecting requests to services such as from Barefruit (www.barefruit.com), ISPs can receive advertising revenue from error pages at the same time as providing a branded and differentiated service to their users.

The more I look the madder I get!!

»www.barefruit.co.uk/?page=solution

quote:
The Barefruit Solution

Because Barefruit operates at the proxy server level, when subscribers encounter errors from any URL they visit, the error pages are replaced with Barefruit Results Pages.

Barefruit pages are flexible in design and can be adapted to represent your brand using an agreed template. Subscribers perceive the pages to be an improvement in the service and technology from their ISP.

The Barefruit Process

This sucks! :mad:

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Thu, 24 Aug 2006 16:26:40 EDT

Doctor Olds : Examples of the Earthlink DNS I am seeing. :[

Re: Oh No They Didn't!

Thu, 24 Aug 2006 16:15:17 EDT

VR Laura : This totally SUCKS. It was bad enough when Verisign did it... But now, my own ISP??!!! :mad:

Laura (ELN customer for 9 years)
»www.queenofcyberspace.com/usenet/

Re: Oh No They Didn't!

Thu, 24 Aug 2006 14:39:30 EDT

Doctor Olds :

said by whfsdude :

Doctor Olds, You're seeing the redirects right?

Sadly Yes. :[ I do not like it one bit. I thought Verisign pulled this redirect crap and ICANN got them to stop it from using SiteFinder. I didn't like it back then either.

»www.icann.org/topics/wildcard-history.html

Who does EL think they are?
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Thu, 24 Aug 2006 14:35:20 EDT

whfsdude : I get the same results as you when I do a ns lookup or a dig but yet the redirects continue to happen.

I'm just using the point of ping to point out that I don't have a proxy or anything on my web browser to cause this to happen.

PING www.fdashkadflskhh.com (209.86.66.94): 56 data bytes
64 bytes from 209.86.66.94: icmp_seq=0 ttl=56 time=671.848 ms
64 bytes from 209.86.66.94: icmp_seq=1 ttl=56 time=23.596 ms
64 bytes from 209.86.66.94: icmp_seq=2 ttl=56 time=28.662 ms

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58320
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
 
;; QUESTION SECTION:
;www.www.fdashkadflskhh.com.    IN      A
 
;; AUTHORITY SECTION:
com.                    900     IN      SOA     a.gtld-servers.net. nstld.verisign-grs.com. 1156444249 1800 900 604800 900
 
;; Query time: 1133 msec
;; SERVER: 207.69.188.186#53(207.69.188.186)
;; WHEN: Thu Aug 24 14:33:31 2006
;; MSG SIZE  rcvd: 117

Re: Oh No They Didn't!

Thu, 24 Aug 2006 12:57:59 EDT

Bill_MI : I suggest direct examples of this phenomena - I do NOT see it here, using below. If you don't like nslookup, use dig. :-)


C:\>nslookup earthlinkmustdie.dslreports.com 207.69.188.186
Server:  ns2.mindspring.com
Address:  207.69.188.186
 
*** ns2.mindspring.com can't find earthlinkmustdie.dslreports.com: Non-existent domain
 
C:\>nslookup earthlinkmustdie.dslreports.com ns1.earthlink.net
Server:  ns1.earthlink.net
Address:  207.217.126.41
 
*** ns1.earthlink.net can't find earthlinkmustdie.dslreports.com: Non-existent domain

Re: Oh No They Didn't!

Thu, 24 Aug 2006 12:25:33 EDT

whfsdude : Doctor Olds, You're seeing the redirects right?

Re: Oh No They Didn't!

Thu, 24 Aug 2006 12:11:06 EDT

Doctor Olds : I'm on Covad regular DSL and this is what IPCP feeds me:

2006-08-24 12:08:06 E |PPP |IPCP nak option: 3
2006-08-24 12:08:06 E |PPP |IPCP nak option: 129
2006-08-24 12:08:06 E |PPP |IPCP nak option: 131
2006-08-24 12:08:06 E |PPP |IPCP up ip: 68.165.8.10x, gw: 172.31.255.251, dns: 207.69.188.186, 207.69.188.185
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Oh No They Didn't!

Thu, 24 Aug 2006 11:26:29 EDT

vinnie97 : Ah you might be onto something.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 11:22:11 EDT

whfsdude :

said by vinnie97 :

With no DNS servers entered, I don't get this redirection.

I wonder if ASDL2+ uses Covad's DNS servers. ;)

Re: Oh No They Didn't!

Thu, 24 Aug 2006 11:18:36 EDT

vinnie97 : With no DNS servers entered, I don't get this redirection.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 11:15:59 EDT

whfsdude :

said by Karl Bode :

Can I get some additional confirmation from other Earthlink users on this?

It should work if you just set your DNS servers to ns1.earthlink.net

Here are the IPs:
will$ host ns1.earthlink
ns1.earthlink has address 209.86.66.91
ns1.earthlink has address 209.86.66.92
ns1.earthlink has address 209.86.66.93
ns1.earthlink has address 209.86.66.94
ns1.earthlink has address 209.86.66.95
ns1.earthlink has address 209.86.66.90

Re: Oh No They Didn't!

Thu, 24 Aug 2006 11:00:42 EDT

Karl Bode : Can I get some additional confirmation from other Earthlink users on this?

Re: Oh No They Didn't!

Thu, 24 Aug 2006 09:30:28 EDT

Doctor Olds : They are doing it now. Bastards! :mad: :mad:

Re: Oh No They Didn't!

Thu, 24 Aug 2006 07:49:57 EDT

Bill_MI : OK, those are ns1/ns2.mindspring.com which I use as forwarders, so I'll see it if it happens again. Good catch.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 07:11:29 EDT

whfsdude : These are what I've been using
207.69.188.186, 207.69.188.185

Edit: It appears they've stopped doing it now but be aware they might start doing it again.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 06:36:11 EDT

Bill_MI : Looking up the non-existing earthlinkmustdie.dslreports.com returns the www.earthlinkhelp.net address? What ELNK-DNS did you see it on?

It isn't now using ns*.earthlink.net or ns*.mindspring.com DNS servers.

Re: Oh No They Didn't!

Thu, 24 Aug 2006 00:55:32 EDT

LightS : What are you talking about? I'm not having any problems whatsoever

Oh No They Didn't!

Wed, 23 Aug 2006 11:49:44 EDT

whfsdude : Earthlink started redirecting failed DNS lookups :-(

»earthlinkmustdie.dslreports.com/

»www.earthlinkhelp.net/?d=error_e···orts.com