Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've just realized that when I enter an URL in the browser and navigate there, if the site doesn't exist I get redirected to a parking site full of ads. Confirmed that the site doesn't exist after checking WHOIS information (domain is available, etc.). My home setup is just a wifi-router with an ADSL service, and my devices going through that wifi connection.

My tests so far:

I guess this could be something bad/malicious in my connection/setup/isp, but I would appreciate any directions to troubleshoot this issue.

share|improve this question

migrated from serverfault.com Apr 7 '13 at 3:59

This question came from our site for system and network administrators.

    
welcome to superuser, now tell us More info :-) who is your ISP? what are the numbers shown for your DNS? What is your operating system? If its windows, what if anything is in the HOSTS file, other than the sample stuff. "Spyware blasters" evil activeX blockers (registry) and evil site lists restriction (IE security) Can filter out some of that stuff, Assembled Hosts blocking files can block out some of it too, all passivly (not running program) What is the browser(s) that your using? –  Psycogeek Apr 7 '13 at 4:34
1  
@Psycogeek thank you. I use linux but there are other devices using windows connected to the network. After following guidance from the answer below I realized one of those computers was infected. –  Matias Apr 7 '13 at 5:12

2 Answers 2

up vote 11 down vote accepted

That would be your ISP 'helping' you.

http://whatis.techtarget.com/definition/DNS-redirection


Or as was pointed out in the comments, your DNS server was compromised or your gateway's DNS settings were changed to point to a malicious DNS server.

See http://www.dcwg.org/ for information on one example of DNS changing malware that targets SOHO routers and how to check/remove the problem.

share|improve this answer
1  
More details available: en.wikipedia.org/wiki/DNS_hijacking –  Chris S Apr 7 '13 at 3:58
2  
@Matias It's possible that your DNS server or the machine acting as the network's default gateway has been compromised. –  Andrew B Apr 7 '13 at 4:09
1  
It could be somone upstream of you but downstream of your ISP. What is the DNS server set up on your router (which I assume is setting the DNS setting on your machines via DHCP or acting as a DNS server itself) –  Scott Chamberlain Apr 7 '13 at 4:09
1  
The redirection would be dependent on the DNS servers you are hitting. If you are configured to use DNS servers in the Czech Republic, or the servers you are using are forwarding to DNS servers there it could happen. –  cpt_fink Apr 7 '13 at 4:10
1  
If that fixed your problem you definitely need to scan PC's and secure your router. The dcwg.org (DNS Changer Working Group) page linked above has a 'fix' page with helpful instructions. –  cpt_fink Apr 7 '13 at 4:45

Sometimes is not about DNS hijacking.

Some spy toolbars/extensions check the return codes of the pages you navigate and redirects you to some custom error pages or parked pages if the return code is not 200 (OK). Check your extensions and also check your installed programs list for toolbars because some programs install them silently taking advantage of our habit of accepting terms automatically.

EDIT: I've just read in the comments that was DNS hijacking. I keep here the answer so future users know about this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.