I think I've just come across a site that has published a list of DrayDNS subdomain names. I say "think" as mine is in that list along with 1000s of others. I randomly tried a few and they resolve to live IPs. Some even took me to the Vigor login page.

Sounds like something has become compromised to me. What's the best way to report this list to Draytek? Is there a security mailbox?....or perhaps raise a support ticket?

a support ticket would be a good start... at least it makes them aware, officially.

Reported to the sales email mailbox.

If/when there is another exploit found in Vigors, this list could be fatal