DNS Cache Poisoning!

Stary

Hi,

Never came across this before... I type in a legitimate address in a browser and it shows a completely different website. Tried other browsers and cleared out cookies etc. Even tried from a smart phone and it was the same. I did get a workaroud by manually adding in Googles DNS (8.8.8.8) into the network settings, so could it be that the modem from the ISP has been compromised? With Imagine over LTE FYi. What do you think?

LambshankRedemption

https://www.boards.ie/discussion/2058318978/dns-cache-poisoning

Care to share the URL? Even over PM if you prefer?

LambshankRedemption

The first thing I would do is check your hosts file. Assuming you are on windows it is located at C:\Windows\System32\etc\hosts. A bit of malware could have dropped in a URL and IP address combination in there to redirect you.

If its not on your PC then it would sound like your ISPs DNS servers have been compromised. Ringing them to tell them or ask them is probably pointless.

Wossack

Check your proxy settings haven’t been altered

28064212

Loads of possibilities. Very first thing to check is to open up a console window and type nslookup website.com (with your DNS servers set to default), then nslookup website.com 8.8.8.8, and compare the results. Then ping website.com and make sure the IP is the same

Hijpo

https://www.boards.ie/discussion/comment/121264902#Comment_121264902

Said its the same on a phone though so would have to a problem with a device common to other devices.

LambshankRedemption

https://www.boards.ie/discussion/comment/121265760#Comment_121265760

I missed the point about the phone. Yeah ok, it's not host specific, so most likely his ISP's DNS server is at fault. Would love to know the URL so I can do some testing myself. OP? As I said, DM me if you dont want to publish the URL.

Stary

https://www.boards.ie/discussion/comment/121264902#Comment_121264902

yes, I did check the hosts, but it looks ok i.e. no added commands

Stary

https://www.boards.ie/discussion/comment/121264880#Comment_121264880

It was mayogaa.com but redirects to https://finalizer.com/

Explosive_Cornflake

Do you know what DNS server imagine are pushing?

It'll be the server section of from nslookup for dig. It'll probably be the LTE router though, which you'll need to log in and check the settings there.

In short, there's nothing to stop the ISP changing the DNS responses, I've seen virgin media do it in some circumstances, e.g. private IP's are sometimes filtered out on public requests. It would be good to get to the bottom of it and see what your DNS server is set to on the internet. I can imagine a situation where your router had an exploit and someone has comprimised it, but that's unlikely, but not impossible.

Imagine ISP issue / look into your router. That’s where likely the issue lies.

LambshankRedemption

https://www.boards.ie/discussion/comment/121274716#Comment_121274716

That is working fine for me. I'll try to look up Imagines DNS server and test with that.

Explosive_Cornflake

That's odd, and I don't think it malicous. If it was some banking or crypto sites, I can understand but for those 2, I think hanlon's razor is valid here.

I can think of 2 explanations from tests I ran, but it could be anything.

1. A badly implemeted 301 at some point in the past on mayogaa.com. This wound't follow your around to devices/private mode/deleting all your cache.
2. Imagine are caching DNS, and ignoring the 60 second TTL on mayogaa.com. Interestingly enough finalizer.com will reply normally sent the host header for mayogaa.com

If you open mayogaa.com on your phone via imagine you get finalizer.com?

Does this happen via imagine if you open an incognito window?

If yes, do the same tests on mobile data.

Stary

https://www.boards.ie/discussion/comment/121275393#Comment_121275393

"If you open mayogaa.com on your phone via imagine you get finalizer.com?" YES

seems like MayoGAA website did have a problem as they were informed of this issue. But even since, the finalizer is still coming up on the phone (PC has manual DNS set, so ok) via Imagine. Going to contact Imagine again to let them know.

Explosive_Cornflake

https://www.boards.ie/discussion/comment/121277261#Comment_121277261

What about the 3 other tests?