0

I been trying to understand what is going on here, but I can't seem to find it.

Yesterday I started noticing that whenever I visit an non existent domain which would usually return an ERR_NAME_NOT_RESOLVED with Chrome, I see instead a parked domain full of ads.

I thought it was adware. I checked with my phone and strangely I also saw the parked domain. At that point I though it was something affecting my home network.

I decided to connect my phone to 4G and check. The parked domain was gone and now I was seeing the ERR_NAME_NOT_RESOLVED as I was supposed to.

I decided to disconnect my computer from the WiFi and connect it to my phone via a mobile hotspot and now my computer also was showing the correct error instead of the parked domain.

At this point I was sure it was the router, so I connected my computer directly to the ethernet cable. The parked domain came back.

When I do a traceroute to the non existent domain I get unknown host fsfsf.fsdfsfsdf.com as expected, even though chrome resolves to the parked domain.

When I use TOR, Safari, or even a VPN I get the ERR_NAME_NOT_RESOLVED as expected. Also, when I use some of my other computers or tablets, with some I see the parked domain and some others resolve to the ERR_NAME_NOT_RESOLVED. The only one resolving correctly to the error is a PC running Windows.

I then opened Wireshark to check for packages and I noticed that Chrome was pinging an IP each time I visited a non existent domain. I visited that IP directly from my browser and I got the same result I see when visiting the unresolved domain.

At this point I am thinking it might be either my ISP (really strange) serving the ads only on Google Chrome, or I have an adware affecting my computer, my phone and a tablet only when connected to my ISP and using Chrome.

Is there any suggestion of anything else I could do to try to figure what is going on and how to resolve it?

My computer is a MacBook running El Capitan 10.11.4 and my phone is a Samsung Galaxy S4

Any tip will be appreciated, Thanks

EDIT: I tried changing the DNS with no luck, but I found out something really odd. When I run the command nslookup this is what I get in return

MY_SYS:dir ambo$ nslookup asdflaksj3lk2jlk23jelk23jlkjlf.com
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   asdflaksj3lk2jlk23jelk23jlkjlf.com.MY-ISP-NAME(!?).com
Address: 192.64.xxx.xxx -> Suspicious IP

So, what does this means? It looks like when I enter a domain name which doesn't exist Chrome is calling a URL with the nonexistent domain name as a subdomain of my ISP domain. When I visit that URL directly I get a similar parked domain as the one I get when I visit a domain which doesn't exists.

Is my ISP hijacking my browser? Why does it happens only on Chrome and only on some devices and not on others if that is the case? I am talking about the biggest ISP in the continent, is it possible that they are really doing this?

4
  • This type of behavior is handled by your DNS server. So change it something other then what your currently using.
    – Ramhound
    Mar 26, 2016 at 16:11
  • Probably your ISP's DNS servers. Change you DNS to google or opendns - 8.8.4.4, 8.8.8.8, 208.67.222.222 and 208.67.220.220.
    – DavidPostill
    Mar 26, 2016 at 17:15
  • 2
    Be sure you are not using a proxy erroneously. I strongly suspect you have some sort of erroneously DNS poisoning happening to you.
    – Ramhound
    Mar 27, 2016 at 3:47
  • Thanks a lot @Ramhound I just found out something else which looks like a solution. I was reading at this answer superuser.com/questions/184361/… and when I checked if I had a search domain under my DNS settings I found out that my ISP domain was there. I changed it for .local and now it looks like I see ERR_NAME_NOT_RESOLVED when domain name does not exist instead of the parked domain. Might that be it? I don't understand though why some devices in my network and browser are afected and some arent in the netwrk
    – JordanBelf
    Mar 27, 2016 at 3:54

1 Answer 1

0

As was stated in the comments, this behavior is caused by your DNS server(s) redirecting on a failed resolution, quite common for ISPs to do this actually.

Since the recommended action is to change to a DNS server that does not do this, such as Google DNS or OpenDNS, you might want to look into a tool called namebench, which will test the speed and "bad behavior" of hundreds of free DNS servers and recommend the fastest ones for your specific application. Namebench is available for Windows, Mac, and Linux, and since it's an open source project, ports are available for FreeBSD, Android, iOS, and other operating systems.

http://www.howtogeek.com/howto/16372/find-a-faster-dns-server-with-namebench/

https://code.google.com/archive/p/namebench/

2
  • Thanks @acejavelin I am testing using OpenDNS and Google DNS with no luck, but I will keep testing. What bugs me is that if it where the DNS why it happens only on chrome and why on some devices and not on others? On the other hand I don't understand why it doesn't happen when I am connected to my mobile network or using a VPN. Thanks again
    – JordanBelf
    Mar 26, 2016 at 18:37
  • I edited my question with new information
    – JordanBelf
    Mar 27, 2016 at 3:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .