[Netalyzr] DNS redirected to third-part​y servers: www.google​.com

[Jim Gettys]

On 06/14/2012 03:40 PM, Maciej Soltysiak wrote:
> Hi Jim,
>  
> My router is latest cerowrt-3.3.8-3, installed about an hour after it
> hit the ftp site.
> I doubt it could got infected so fast.

Nor is the CeroWrt default password in their list, I would guess.

>  
> Anyway, when I initially directly asked 8.8.8.8 for www.google.com
> <http://www.google.com> it never responded with the 42.x.y.z
> addresses, but some other ones.  Now, after some time, it does as
> well, so I'm feeling calm now.

Yeah, I like the Comcast DNS servers best (since they are closest, have
great performance and implement DNSSEC); when I can't get them, I use
Google.
               - Jim

>  
> Thanks,
> Maciej
>
>
>  
> On Thu, Jun 14, 2012 at 9:33 PM, Jim Gettys <jg at freedesktop.org
> <mailto:jg at freedesktop.org>> wrote:
>
>     On 06/14/2012 02:32 PM, Nicholas Weaver wrote:
>     > I think this may be a false positive:
>     >
>     > The systems respond like standard Google servers, both in normal
>     communication and in errors (previous situations where this
>     occured had the servers respond differently to errors than
>     legitimate Google servers).  So it could be Google has added some
>     new servers in Poland, but not updated the reverse DNS.  I will
>     contact a friend at google to confirm...
>
>     DNSchanger?  Remember, that malware attacks your home router as
>     well as
>     your hosts....
>                        - Jim
>
>     >
>     > However, if you want to be extra sure, you can switch to Google
>     Public DNS (8.8.8.8 and 8.8.4.4
>     >
>     >
>     > On Jun 14, 2012, at 11:26 AM, Maciej Soltysiak wrote:
>     >
>     >> Hi,
>     >>
>     >> My netalyzr runs recently start to show that my ISP redirects
>     www.google.com <http://www.google.com> to 3rd party.
>     >> I would like to make sure it's me or my ISP and not something
>     changed in google CDN or Netalyzr so could anyone else verify if
>     you are getting similar results, please?
>     >> My run is here:
>     >>
>     http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-21386-3947730d-5148-4bce-9140#DNSLookup
>     >>
>     >> The IPs that get resolved are:
>     >> 46.28.247.113
>     >> 46.28.247.118
>     >>
>     >> Possible reasons:
>     >> - DNS issues on my home router, which has a bit experimental
>     software (cerowrt from bufferbloat.net <http://bufferbloat.net>),
>     but it didn't show before on same firmware.
>     >> - Ongoing cache poisoning attack. My ISP DNS is 62.21.99.95
>     >> - this might be if google is using another pool for CDN then
>     it's a false positive. -- I'm located in Poznan, Poland, (Europe)
>     >>
>     >> Best regards,
>     >> Maciej Soltysiak
>     >>
>     >> _______________________________________________
>     >> Netalyzr mailing list
>     >> Netalyzr at mailman.ICSI.Berkeley.EDU
>     <mailto:Netalyzr at mailman.ICSI.Berkeley.EDU>
>     >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/netalyzr
>     >
>     > _______________________________________________
>     > Netalyzr mailing list
>     > Netalyzr at mailman.ICSI.Berkeley.EDU
>     <mailto:Netalyzr at mailman.ICSI.Berkeley.EDU>
>     > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/netalyzr
>
>