I been trying to understand what is going on here, but I can't seem to find it.
Yesterday I started noticing that whenever I visit an non existent domain which would usually return an ERR_NAME_NOT_RESOLVED
with Chrome, I see instead a parked domain full of ads.
I thought it was adware. I checked with my phone and strangely I also saw the parked domain. At that point I though it was something affecting my home network.
I decided to connect my phone to 4G and check. The parked domain was gone and now I was seeing the ERR_NAME_NOT_RESOLVED
as I was supposed to.
I decided to disconnect my computer from the WiFi and connect it to my phone via a mobile hotspot and now my computer also was showing the correct error instead of the parked domain.
At this point I was sure it was the router, so I connected my computer directly to the ethernet cable. The parked domain came back.
When I do a traceroute to the non existent domain I get unknown host fsfsf.fsdfsfsdf.com
as expected, even though chrome resolves to the parked domain.
When I use TOR
, Safari
, or even a VPN
I get the ERR_NAME_NOT_RESOLVED
as expected. Also, when I use some of my other computers or tablets, with some I see the parked domain and some others resolve to the ERR_NAME_NOT_RESOLVED
. The only one resolving correctly to the error is a PC running Windows.
I then opened Wireshark to check for packages and I noticed that Chrome was pinging an IP each time I visited a non existent domain. I visited that IP directly from my browser and I got the same result I see when visiting the unresolved domain.
At this point I am thinking it might be either my ISP (really strange) serving the ads only on Google Chrome, or I have an adware affecting my computer, my phone and a tablet only when connected to my ISP and using Chrome.
Is there any suggestion of anything else I could do to try to figure what is going on and how to resolve it?
My computer is a MacBook running El Capitan 10.11.4
and my phone is a Samsung Galaxy S4
Any tip will be appreciated, Thanks
EDIT: I tried changing the DNS with no luck, but I found out something really odd. When I run the command nslookup
this is what I get in return
MY_SYS:dir ambo$ nslookup asdflaksj3lk2jlk23jelk23jlkjlf.com
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: asdflaksj3lk2jlk23jelk23jlkjlf.com.MY-ISP-NAME(!?).com
Address: 192.64.xxx.xxx -> Suspicious IP
So, what does this means? It looks like when I enter a domain name which doesn't exist Chrome is calling a URL with the nonexistent domain name as a subdomain of my ISP domain. When I visit that URL directly I get a similar parked domain as the one I get when I visit a domain which doesn't exists.
Is my ISP hijacking my browser? Why does it happens only on Chrome and only on some devices and not on others if that is the case? I am talking about the biggest ISP in the continent, is it possible that they are really doing this?