Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I open a browser and try to open a "lksdjklsdj" domain, I'm redirected to some IP address (217.115.192.15).

Also, if I ping "kslaxcsd", I also get a reply from the same IP, instead of "host unknown".

I've searched for spyware, hosts file, registry, ... and I can't find any reference to this IP address.

Is it perhaps up to my DNS who is serving me that IP!?

Update: I have set Google DNS in my network properties for the current connection (Windows 7), and I still get the same behaviour.

nslookup -debug blahblah.blah result:

------------
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

------------
Got answer:
    HEADER:
    opcode = QUERY, id = 2, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.com, type = A, class = IN
    AUTHORITY RECORDS:
    ->  MY-COMPANY-NAME.com
    ttl = 1800 (30 mins)
    primary name server = ns1.MY-COMPANY-NAME.com
    responsible mail addr = dns.MY-COMPANY-NAME.com
    serial  = 2011010800
    refresh = 28800 (8 hours)
    retry   = 7200 (2 hours)
    expire  = 1209600 (14 days)
    default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 3, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  MY-COMPANY-NAME.com
    ttl = 1800 (30 mins)
    primary name server = ns1.MY-COMPANY-NAME.com
    responsible mail addr = dns.MY-COMPANY-NAME.com
    serial  = 2011010800
    refresh = 28800 (8 hours)
    retry   = 7200 (2 hours)
    expire  = 1209600 (14 days)
    default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 4, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.eu, type = A, class = IN
    ANSWERS:
    ->  blahblah.blah.MY-COMPANY-NAME.eu
    internet address = 217.115.192.15
    ttl = 900 (15 mins)

------------
------------
Got answer:
    HEADER:
    opcode = QUERY, id = 5, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    blahblah.blah.MY-COMPANY-NAME.eu, type = AAAA, class = IN

------------
Name:    blahblah.blah.MY-COMPANY-NAME.eu
Address:  217.115.192.15

share|improve this question
    
Can you post the output from 'nslookup -debug nowhere.blah' –  EightBitTony Aug 7 '11 at 15:40
    
I've edited the question and just replaced the name of my company with the text MY-COMPANY-NAME. Mind you, I am NOT at the office right now and I'm using home DSL line. –  miyo Aug 7 '11 at 15:51
    
Have you done a DNS flush AFTER you changed your DNS settings to Googles? "ipconfig /flushdns" from the command prompt? –  TFM Aug 7 '11 at 15:56
    
Yes, and /registerdns, and I've rebooted - of course :) –  miyo Aug 7 '11 at 15:58
1  
It's not, it looks like a wildcard DNS entry. –  EightBitTony Aug 7 '11 at 16:05
add comment

2 Answers

up vote 1 down vote accepted

Looks to me like your company has a wildcard DNS entry setup, and your machine has a search list or domain set to be MY-COMPANY-NAME.eu

So, anything that doesn't resolve has MY-COMPANY-NAME.eu appended and tried again, and for some reason, there's a wildcard DNS entry for *.MY-COMPANY-NAME.eu so it will always resolve to that IP address.

share|improve this answer
    
I tried - same thing. –  miyo Aug 7 '11 at 15:33
    
Where can I see that setting or that search list? Is it a domain group policy? –  miyo Aug 7 '11 at 16:09
    
Out of my area that sorry, I just know why it's doing it. The other question is, does your company know it has a wildcard DNS entry on it's domain pointing to a Dutch hosting company. Removing that would also solve your issue, your search list is useful when trying to talk to other hosts in the same domain, but when you only want to use shortnames –  EightBitTony Aug 7 '11 at 16:12
    
You are right, I'll talk to the network admins, thanks for the entire debugging session. :) –  miyo Aug 7 '11 at 19:46
add comment

Windows, like every other OS, maintains a list of "suffixes" to append automatically when doing DNS resolution. For example, if your computer is connected to example.com.'s network, it will have "example.com." in the suffix list. (This is useful when accessing other computers by name – you only need to type "mailserver" instead of "mailserver.example.com.", for example.)

However, Windows applies this to all non-absolute domain names – those that don't end with a . – and by default, it first tries with the suffix appended. So if you enter "does.not.exist", Windows tries "does.not.exist.example.com." first, and "does.not.exist." after that.

The problem is that your current domain has a wildcard record set up, which is automatically returned for all subdomains that don't exist. When you enter "does.not.exist", Windows tries "does.not.exist.example.com.", which will match the "*.example.com." wildcard.


One solution is to configure Windows to try appending "." before your company's domain. On Windows XP, open Network Connections, right-click your network interface, and choose Properties, then Internet Protocol (TCP/IPv4)PropertiesAdvancedDNS.

Choose the Append these DNS suffixes (in order) option, and add . (a single dot) as the first entry. Optionally, you can add MY-COMPANY-NAME.eu. below it. Finally, click OK.

Note that this setting is sometimes enforced by Group Policy; in this case, complain to your network administrators.

share|improve this answer
    
Other OS's do this optionally, it's not forced behaviour. My linux machine here doesn't append anything, unless you put a search entry into resolv.conf. –  EightBitTony Aug 7 '11 at 16:14
    
@EightBitTony: Neither does Windows force you into it -- however, both Windows and most Linuxes do it by default. When I connect to my DHCP-enabled network, the default settings of dhcpcd are to add home. to the resolv.conf search list. –  grawity Aug 7 '11 at 16:24
    
Fine, but I think "Windows, like every other OS, maintains a list of "suffixes"" is misleading. Windows, like every other OS, may maintain a list of .... –  EightBitTony Aug 7 '11 at 16:37
    
Excellent explanation @gravity, I wish I could accept both answers. Thanks. –  miyo Aug 7 '11 at 19:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.