4

I've just realized that when I enter an URL in the browser and navigate there, if the site doesn't exist I get redirected to a parking site full of ads. Confirmed that the site doesn't exist after checking WHOIS information (domain is available, etc.). My home setup is just a wifi-router with an ADSL service, and my devices going through that wifi connection.

My tests so far:

I guess this could be something bad/malicious in my connection/setup/isp, but I would appreciate any directions to troubleshoot this issue.

Improve this question
2
  • welcome to superuser, now tell us More info :-) who is your ISP? what are the numbers shown for your DNS? What is your operating system? If its windows, what if anything is in the HOSTS file, other than the sample stuff. "Spyware blasters" evil activeX blockers (registry) and evil site lists restriction (IE security) Can filter out some of that stuff, Assembled Hosts blocking files can block out some of it too, all passivly (not running program) What is the browser(s) that your using?
    – Psycogeek
    Apr 7, 2013 at 4:34
  • 1
    @Psycogeek thank you. I use linux but there are other devices using windows connected to the network. After following guidance from the answer below I realized one of those computers was infected.
    – mati
    Apr 7, 2013 at 5:12

2 Answers 2

Reset to default
11

That would be your ISP 'helping' you.

http://whatis.techtarget.com/definition/DNS-redirection

Or as was pointed out in the comments, your DNS server was compromised or your gateway's DNS settings were changed to point to a malicious DNS server.

See http://www.dcwg.org/ for information on one example of DNS changing malware that targets SOHO routers and how to check/remove the problem.

Improve this answer
7
  • 1
    More details available: en.wikipedia.org/wiki/DNS_hijacking
    – Chris S
    Apr 7, 2013 at 3:58
  • 2
    @Matias It's possible that your DNS server or the machine acting as the network's default gateway has been compromised.
    – Andrew B
    Apr 7, 2013 at 4:09
  • 1
    It could be somone upstream of you but downstream of your ISP. What is the DNS server set up on your router (which I assume is setting the DNS setting on your machines via DHCP or acting as a DNS server itself)
    – Scott Chamberlain
    Apr 7, 2013 at 4:09
  • 1
    The redirection would be dependent on the DNS servers you are hitting. If you are configured to use DNS servers in the Czech Republic, or the servers you are using are forwarding to DNS servers there it could happen.
    – cpt_fink
    Apr 7, 2013 at 4:10
  • 1
    If that fixed your problem you definitely need to scan PC's and secure your router. The dcwg.org (DNS Changer Working Group) page linked above has a 'fix' page with helpful instructions.
    – cpt_fink
    Apr 7, 2013 at 4:45
2

Sometimes is not about DNS hijacking.

Some spy toolbars/extensions check the return codes of the pages you navigate and redirects you to some custom error pages or parked pages if the return code is not 200 (OK). Check your extensions and also check your installed programs list for toolbars because some programs install them silently taking advantage of our habit of accepting terms automatically.

EDIT: I've just read in the comments that was DNS hijacking. I keep here the answer so future users know about this.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.