{ "domain": "craigslist.org", "records": { "ns": [ "ns1a.craigslist.org", "ns1f.craigslist.org", "ns2a.craigslist.org", "ns2f.craigslist.org", "ns9a.craigslist.org", "ns9f.craigslist.org" ], "a": [ "208.82.237.129" ], "aaaa": null, "mx": [ { "pref": 10, "host": "mxicorpa.craigslist.org" } ], "cname": null, "txt": [ "abuseipdb-verification=stnsjho8", "cisco-ci-domain-verification=49705dd0c370cf0b94605d2e2f8909106fd1e4062475d3c0d36b3e4272451dc3", "google-site-verification=o1pso3g__mi-abg-rr0y_ow2readorqabkzmqf2qdle", "v=spf1 ip4:208.82.237.96/29 ip4:208.82.237.104/31 ip4:208.82.238.96/29 ip4:208.82.238.104/31 -all", "yahoo-verification-key=mnhb1ijdrrojapwym/rsqcqkxzztspstjcxwztw5ynq=" ], "caa": [ "\\# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d", "\\# 37 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 65 63 75 72 69 74 79 40 63 72 61 69 67 73 6c 69 73 74 2e 6f 72 67" ], "soa": "ns1f.craigslist.org. hostmaster.craigslist.org. 2026072802 10800 1800 2419200 300", "ds": null, "dnskey": null, "has_dnssec": false }, "ns_hosts": [ { "host": "ns1a.craigslist.org", "ip": "208.82.237.71", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "ns1f.craigslist.org", "ip": "208.82.238.71", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.238.0/24", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "ns2a.craigslist.org", "ip": "208.82.237.72", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "ns2f.craigslist.org", "ip": "208.82.238.72", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.238.0/24", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "ns9a.craigslist.org", "ip": "208.82.237.79", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "ns9f.craigslist.org", "ip": "208.82.238.79", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.238.0/24", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false } ], "web_hosts": [ { "host": "craigslist.org", "ip": "208.82.237.129", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false } ], "mx_hosts": [ { "host": "mxicorpa.craigslist.org", "ip": "208.82.237.80", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false }, { "host": "mxicorpa.craigslist.org", "ip": "208.82.237.81", "asn": 22414, "as_name": "CRAIGS-NET-1 - Craigslist, Inc.", "prefix": "208.82.236.0/22", "country": "US", "provider": "CRAIGS-NET-1 - Craigslist, Inc.", "kind": "", "anycast": false } ], "findings": [ { "layer": "network", "severity": "critical", "title": "Nameservers and web origin in one ASN", "detail": "Authoritative DNS and the web origin both live in AS22414 (CRAIGS-NET-1 - Craigslist, Inc.). One BGP withdrawal or network outage removes name resolution and the origin together — with DNS gone there is no failover path. This is exactly how Facebook took itself fully offline in 2021.", "evidence": [ "ns1a.craigslist.org → 208.82.237.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns1f.craigslist.org → 208.82.238.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2a.craigslist.org → 208.82.237.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2f.craigslist.org → 208.82.238.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9a.craigslist.org → 208.82.237.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9f.craigslist.org → 208.82.238.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "craigslist.org → 208.82.237.129 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US" ], "remediate": "Move authoritative DNS onto a wholly independent network so resolution survives an origin-network outage." }, { "layer": "dns", "severity": "high", "title": "All nameservers in one ASN", "detail": "Every nameserver lives in AS22414 (CRAIGS-NET-1 - Craigslist, Inc.). A single BGP or network failure there takes the whole domain offline — the failure mode behind the 2016 Dyn outage.", "evidence": [ "ns1a.craigslist.org → 208.82.237.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns1f.craigslist.org → 208.82.238.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2a.craigslist.org → 208.82.237.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2f.craigslist.org → 208.82.238.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9a.craigslist.org → 208.82.237.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9f.craigslist.org → 208.82.238.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US" ], "remediate": "Add a secondary DNS provider on a different ASN." }, { "layer": "dns", "severity": "medium", "title": "All nameservers in one country", "detail": "Every nameserver geolocates to US. Regional connectivity, regulatory, or disaster events become correlated failures.", "evidence": [ "ns1a.craigslist.org → 208.82.237.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns1f.craigslist.org → 208.82.238.71 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2a.craigslist.org → 208.82.237.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns2f.craigslist.org → 208.82.238.72 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9a.craigslist.org → 208.82.237.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "ns9f.craigslist.org → 208.82.238.79 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US" ], "remediate": "Spread nameservers across regions, or use an anycast provider with global PoPs." }, { "layer": "web", "severity": "medium", "title": "Single web origin IP", "detail": "The site resolves to exactly one IP with no CDN in front. That host is a hard single point of failure.", "evidence": [ "craigslist.org → 208.82.237.129 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US" ], "remediate": "Put the origin behind a CDN/anycast layer, or publish multiple origins across networks." }, { "layer": "mail", "severity": "medium", "title": "Mail concentrated in one ASN", "detail": "All MX hosts resolve into AS22414 (CRAIGS-NET-1 - Craigslist, Inc.). Mail is queue-and-retry tolerant, but a sustained network failure still blocks delivery.", "evidence": [ "mxicorpa.craigslist.org → 208.82.237.80 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US", "mxicorpa.craigslist.org → 208.82.237.81 · AS22414 CRAIGS-NET-1 - Craigslist, Inc. · US" ], "remediate": "Publish MX records pointing at independently-networked mail infrastructure." }, { "layer": "web", "severity": "low", "title": "No CDN in front of the origin", "detail": "The origin is directly exposed: no anycast absorption, no edge caching, and the origin IP is visible for targeted attack.", "evidence": null, "remediate": "Front the site with a CDN (Cloudflare, Fastly, CloudFront, …)." }, { "layer": "dns", "severity": "low", "title": "DNSSEC not enabled", "detail": "No DS record at the parent: responses are not cryptographically authenticated and can be forged by an on-path attacker or a poisoned resolver.", "evidence": null, "remediate": "Enable DNSSEC signing and publish a DS record at the registrar. (Automate key rollover — misconfigured DNSSEC can itself cause outages.)" } ], "grade": "F", "score": 7, "has_cdn": false }