Skip to content

Microsoft.com Domain Hijacked?

Currently you can visit:

<p><a href="http://rebar.one.microsoft.com/">http://rebar.one.microsoft.com/</a> and see a standard parked-domain search-engine type site <small>[<a href="http://bfccomputing.com/cache/blog/rebar.one.microsoft.com/">cache</a>]</small></p>
<p>The DNS is hosted by Microsoft, but someone appears to have hijacked it:</p>
<p><code style="text-align: left">host rebar.one.microsoft.com<br />

rebar.one.microsoft.com is an alias for license.empiredrm.com.
license.empiredrm.com is an alias for ad.funnel.revenuedirect.com.akadns.net.
ad.funnel.revenuedirect.com.akadns.net has address 66.150.161.56
ad.funnel.revenuedirect.com.akadns.net has address 69.25.47.163

<p>This is only funny if you don’t have your systems set to trust .microsoft.com. for software updates or run a Microsoft DNS server you expect to be secure.</p>
<p><b>Edit:</b> On second consideration, the more likely scenario is that Microsoft once used <a href="http://web.archive.org/web/20030320001015/www.empiredrm.com/">EmpireDRM</a> for something or at least did a trial and forgot to clean up their DNS when EmpireDRM went away.  Then somebody bought up the domain and has been selling ads on it.  The risk may still exist if you trust .microsoft.com, depending on how CNAME’s are handled, but it looks less likely that there was a hijack.</p>