I been trying to understand what is going on here, but I can't seem to find it.
Yesterday I started noticing that whenever I visit an non existent domain which would usually return an
ERR_NAME_NOT_RESOLVED with Chrome, I see instead a parked domain full of ads.
I thought it was adware. I checked with my phone and strangely I also saw the parked domain. At that point I though it was something affecting my home network.
I decided to connect my phone to 4G and check. The parked domain was gone and now I was seeing the
ERR_NAME_NOT_RESOLVED as I was supposed to.
I decided to disconnect my computer from the WiFi and connect it to my phone via a mobile hotspot and now my computer also was showing the correct error instead of the parked domain.
At this point I was sure it was the router, so I connected my computer directly to the ethernet cable. The parked domain came back.
When I do a traceroute to the non existent domain I get
unknown host fsfsf.fsdfsfsdf.com as expected, even though chrome resolves to the parked domain.
When I use
Safari, or even a
VPN I get the
ERR_NAME_NOT_RESOLVED as expected. Also, when I use some of my other computers or tablets, with some I see the parked domain and some others resolve to the
ERR_NAME_NOT_RESOLVED. The only one resolving correctly to the error is a PC running Windows.
I then opened Wireshark to check for packages and I noticed that Chrome was pinging an IP each time I visited a non existent domain. I visited that IP directly from my browser and I got the same result I see when visiting the unresolved domain.
At this point I am thinking it might be either my ISP (really strange) serving the ads only on Google Chrome, or I have an adware affecting my computer, my phone and a tablet only when connected to my ISP and using Chrome.
Is there any suggestion of anything else I could do to try to figure what is going on and how to resolve it?
My computer is a MacBook running
El Capitan 10.11.4 and my phone is a
Samsung Galaxy S4
Any tip will be appreciated, Thanks
EDIT: I tried changing the DNS with no luck, but I found out something really odd. When I run the command
nslookup this is what I get in return
MY_SYS:dir ambo$ nslookup asdflaksj3lk2jlk23jelk23jlkjlf.com Server: 22.214.171.124 Address: 126.96.36.199#53 Non-authoritative answer: Name: asdflaksj3lk2jlk23jelk23jlkjlf.com.MY-ISP-NAME(!?).com Address: 192.64.xxx.xxx -> Suspicious IP
So, what does this means? It looks like when I enter a domain name which doesn't exist Chrome is calling a URL with the nonexistent domain name as a subdomain of my ISP domain. When I visit that URL directly I get a similar parked domain as the one I get when I visit a domain which doesn't exists.
Is my ISP hijacking my browser? Why does it happens only on Chrome and only on some devices and not on others if that is the case? I am talking about the biggest ISP in the continent, is it possible that they are really doing this?