It's almost exactly a year since Dan Kaminsky announced what has been described the as "as the most egregious network security flaw in 10 years". Long enough, it could be thought, for the network admins at the world's ISPs to get their shops in order and eliminate the bug. Especially, since the work of actually eliminating the vulnerability had been undertaken by the authors of the various vulnerable versions of Bind within weeks of the announcement, and all that was required at the ISP level is to install the patch.
Recently, however, it came to my notice that random name requests to Irish ISP, Eircom's nameservers were being sent to link farm advertising pages. I wrote this off as a function of the network I was on when I noticed this, as large shared networks tend to be prone to all sorts of daft issues. This morning, however, I had a conversation with someone who was experiencing strange problems with obviously hijacked pages appearing for domains like google.ie and eircom.net and this spurred me to attempt a little research.
The primary and secondary nameservers advertised by Eircom, 213.94.190.236 and 213.94.190.194 are unfortunately unavailable at this time. The IPs are up and on the internet, but the nameservers are not responding to queries. Whether this is because they are currently being patched, or because of some other outage is uncertain.
A test (one of many) has been made available by Steve Gibson of Gibson Research Corporation to determine if your DNS is vulnerable to the kaminsky bug.
On a final note, I would recommend using OpenDNS or equivalent than the often broken DNS provided by ISPs.




