Networking – I’m being redirected to a parking site when dns resolution fails

dnsnetworking

I've just realized that when I enter an URL in the browser and navigate there, if the site doesn't exist I get redirected to a parking site full of ads. Confirmed that the site doesn't exist after checking WHOIS information (domain is available, etc.).
My home setup is just a wifi-router with an ADSL service, and my devices going through that wifi connection.

My tests so far:

Navigate to http://laksdkajsndkajndkasn.net >> get 302 redirect to malicious page
Navigate to http://laksdkajsndkajndkasn.net (other browser) >> get 302 redirect to malicious page
Navigate to http://laksdkajsndkajndkasn.net (mobile connected to same network) >> redirected to malicious page
Navigate to http://laksdkajsndkajndkasn.net (mobile connected to 3G network) >> NOT redirected to malicious page
Curl http://laksdkajsndkajndkasn.net >> resolves an IP address but get a 404 response with content-length 0. Go to that IP in the browser >> redirects to parking site.
dnslookup http://laksdkajsndkajndkasn.net >> I see that IP under "Non-authoritative answer:"

I guess this could be something bad/malicious in my connection/setup/isp, but I would appreciate any directions to troubleshoot this issue.

Best Answer

That would be your ISP 'helping' you.

http://whatis.techtarget.com/definition/DNS-redirection

Or as was pointed out in the comments, your DNS server was compromised or your gateway's DNS settings were changed to point to a malicious DNS server.

See http://www.dcwg.org/ for information on one example of DNS changing malware that targets SOHO routers and how to check/remove the problem.

Related Solutions

Google-chrome – How to prevent URL redirects in Chrome

I realize this is far from a perfect answer, as this will only work for responses that serve up content, but I decided to post it as there are currently zero useful, actionable answers.

As a quick-and-dirty solution you may be able to use the debugger (accessible by F12 or CTRL+SHIFT+I in most browsers) to give your self an opportunity to opt out of a redirect.

Run this line in the console before the page runs any scripts of its own:

window.onbeforeunload = function(){ return 'Leave page?'; };

For example, using Chrome:

Open the debugger (F12) and switch to the Sources tab.
Press F8 to put the debugger into step-through mode.
Navigate to the problematic page. It will begin to load but the debugger won't allow scripts to run.
Paste the above code into the console and hit enter.
Press F8 again to allow scripts to run and let the page finish loading.
Now you will see a prompt before any redirect occurs and you'll have an opportunity to cancel it.
If the page repeatedly tries to redirect you, you can tell chrome not to display the dialog again. Further attempts by the page to navigate you elsewhere will fail silently.

Does the original site work, but port forwarding to the same site fails

What you are missing

An HTTP(s) client will tell the server the name it is using to reach it (that allows for example multiple sites with different names to be hosted by the same server).

So, if the client says to www.google.com:

Hi www.google.com, please serve your home page

It works. But if the client says to www.google.com:

Hi localhost, please serve your home page

then the server does not quite know what you mean, because no localhost webserver is located there.

Alternative commands

You need to fake the "Host:" header that the client sends with the HTTP request. Otherwise, the hostname in the URL will be used. A couple of examples:

wget --header="Host: www.google.com" http://localhost:8888/

curl --header "Host: www.google.com" http://localhost:8888/