Feature or vulnerability of reg.ru DNS servers?

Question

Information Security

There was an unpleasant situation with reg.ru.

A domain was bought on reg.ru, it automatically had DNS servers ns1.hosting.reg.ru and ns2.hosting.reg.ru.
Approximately 20 days later, returning to the project, I discovered that the domain had an A-record with the IP address 147.135.191.81 of some "left" hosting. And also, the domain has been blacklisted in Google Safebrowsing and Yandex Safebrowsing. When visiting the site, the browser displays a red screen with the inscription "Beware of a fake site!".

Contacted those. support, with the question of what is happening and how they could register an A-record for my domain.
Answer:

When using hosting DNS servers ns1.hosting.reg.ru and ns2.hosting.reg.ru, the domain is automatically bound to the hosting service where it was added earlier. That is, your domain was previously added to another hosting service, and when you specified DNS servers ( I did not indicate that they were registered automatically when buying a domain ), it was automatically linked to this service.

We've updated the domain's DNS zone and redirected it to your hosting service.

This is the peculiarity of the work of the DNS servers ns1.hosting.reg.ru and ns2.hosting.reg.ru, when adding a domain to the hosting, resource records are added automatically so that the site is immediately ready for work. However, if the domain has already been added to the hosting, it is linked to this hosting. To exclude this possibility, you can use DNS ns1.reg.ru and ns2.reg.ru and manually link the domain to the hosting. Information on DNS data is available at the link.

If such a situation arises, at the request of the domain owner, we redirect the domain to the required hosting service.

Do you think this case is a consequence of a vulnerability and incorrect operation of reg.ru, or is this a normal situation and just a "feature of DNS servers"?

PS
Has anyone encountered getting into Google Safebrowsing and Yandex Safebrowsing, how fast / difficult is it to get out of there and will this story affect the further promotion of the site?

UPD.
At the moment, the site is already in 4 databases, I think they take information from each other. You will have to spend a lot of time and effort to whitewash the domain :(

Answer 1

Regarding the cleaning of the domain from the database, this is absolutely not a problem, it usually takes from 2 days to a week.
1) Attach your clean site to the domain,
2) add the console and Yandex webmaster to the Google console, in both systems there is a site check for viruses. Apply for a site review.
3) ESET. Information is on this page . They need to unsubscribe to their email (preferably in English) that the site is false positive.
4) Sophos AV. Go to this page , select "Web Address" and fill out the form, write in the comment that "false positive url"
ps. If another antivirus is added, then we look for the antivirus website and feedback forms or support mail and unsubscribe there with the mark "False Positive Submission". Usually companies respond within 1-3 days and remove the site.
ps2. From my own experience, I will say that it will not affect the history of the domain, I cleaned more than a dozen sites from viruses, closed holes. Then he unsubscribed to antivirus companies and the site returned to the search engine and back to the search tops (of course, if it was there before =))

Answer 2

reg.ru handles dns in a strange way. If you, for example, enable https through their lk, then ns will change. If there was one ns record, then you changed it, then in the course of editing dns you may find that the old ns is being distributed again.

Answer 3

Hmm, when buying a domain, they ask you which NS servers you will use. reg.ru has several NS servers, those with "hosting" for their hosting service, those that are just ns1.reg.ru is a regular DNS hosting (free for regru clients). Accordingly, if you transfer the domain to the hosting NS, then it will be tied to the service, if such is registered (I agree, it’s a cant that they didn’t check that the service belongs to the domain owner). So it turns out carelessness + features of hosting NS