20

I am being redirected to the website "http://domain-error.com". This is happening in Firefox, Chromium, Google chrome etc. I feel I am attacked by a virus or something similar to that.

Firefox screenshot

Update: the redirection happens quite frequently but, not always and is experiencing in all browser.

Firefox Add-ons Manager shows, "Ubuntu Modifications 3.2(Disabled)". Firefox Plug-ins shows "OpenH264 Video Codec provided by Cisco Systems, Inc.1.5.1". /etc/hosts is as follows:

127.0.0.1   localhost
127.0.1.1   home-desktop

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

host google.com results as follows

home@home-desktop:~$ host google.com
google.com has address 216.58.220.14
google.com has IPv6 address 2404:6800:4009:804::200e
;; connection timed out; no servers could be reached
home@home-desktop:~$ host google.com
google.com has address 216.58.220.14
google.com has IPv6 address 2404:6800:4009:804::200e
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.


home@home-desktop:~$ host google.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases: 

google.com has address 216.58.196.14
google.com has IPv6 address 2404:6800:4009:805::200e
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

ClamTk Virus Scanner result as follows. But, after removing this virus reappears.

/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/74FFA44984EB1C9A25C368933E368C017D1BA402: PUA.Script.Packed-2 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/975E967B7FAAC093533721489F38B5558E903CD6: PUA.JS.Xored FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/DC2B9FDFADA8ACF2A73587FB7C1363C96D865641: PUA.Script.Packed-2 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/D18ACE6C2F38228A99A6F24DEF604B65FE8EAD4D: PUA.Script.Packed-2 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/F0B2C1E21FAB8944116EE80787C026D0ACD117B3: PUA.Script.Packed-2 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/229277790D7F8A68B7983C1B74110047842CAB9F: PUA.Http.Exploit.CVE_2015_1692 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/3E710D766C56B38839F2FA8857831ED099BCE52A: PUA.JS.Xored FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/10E466A6C5B7E8510DE813F537F27B186D75E2B6: PUA.Script.Packed-1 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/697815FD2C3AA32190D6EBEDC60695379DD6E754: PUA.Script.Packed-2 FOUND
/home/home/.cache/mozilla/firefox/l5cuof0l.default/cache2/entries/54B8B0B2368584CAC24E39B23E4493BEC8EC61D0: PUA.Http.Exploit.CVE_2015_1692 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 4156276
Engine version: 0.98.7
Scanned directories: 392
Scanned files: 3020
Infected files: 10
Data scanned: 891.88 MB
Data read: 737.67 MB (ratio 1.21:1)
Time: 68.872 sec (1 m 8 s)

I was away ... I feel this as BSNL phenomenon. Today again The problem resurfaced. Now I have changed DNS server to openDNS... Hope this will solve the problem.. Thans for everybody for looking in to the problem.

16
  • 5
    Does this happen with every site you want to visit? Or only sites that do not exist?
    – Jos
    Dec 12, 2015 at 10:39
  • Looks like some kind of search ad-ware has made its self your default notice even though the it claims to be Google the address is not Google and it is clearly advertising some sites to you, go to preferences >> search and see who your search provider is (Google by default)
    – Mark Kirby
    Dec 12, 2015 at 10:54
  • 3
    4,156,276 viruses? You need to reinstall Ubuntu, dude.
    – Star OS
    Dec 15, 2015 at 9:25
  • 1
    Hi I am experiencing the same problem since two weeks, It happens for the domain that's dns is not resolved, probably the ones which are expired. It happens on my tablets and phones too when connected to the same network. reset your modem and see what happens!! (you must know how to configure it )
    – x0x
    Dec 17, 2015 at 11:15
  • 1
    Maybe your isp is redirecting your DNS traffic: ckollars.org/dns-intercepting.html Could you set-up a VPN or use any proxy service?
    – iuridiniz
    Dec 21, 2015 at 8:42

7 Answers 7

14
+50

I am having this issue since a few days.

The problems are:

  • Invalid domains are redirected to domain-error.com
  • Some domains are redirected to domain-error.com multiple times but after a few attempts I could reach the website.

I have got the same problem in Ubuntu, Archlinux, Windows(7 and 10). I am not saying that getting the same malware in all these operating system is impossible.

But What is impossible (nearly):
I downloaded a fresh copy of Ubuntu from the official website. Verified the integrity and live booted. Then I tried to reach an invalid URL.

Guess what happened!. I was again redirected tohttp://domain-error.com/

So the problem is with the Internet Service Provider(ISP)?

To confirm that I went to my friends apartment, who is using the same ISP and he is having the same problem.

I have blocked domain-error.com from loading (added entry to /etc/hosts) but the redirect still exist.

So I think that you are also having the same issue with the ISP.

SOLUTION:

Remove default DNS option from your router and set 8.8.8.8 and 8.8.4.4 as your DNS. It will work fine.

Note: My ISP is BSNL (India)

.

6
  • 1
    Did you try to contact your ISP?
    – dadexix86
    Dec 18, 2015 at 11:49
  • Waiting for some days. May be they are working on it.
    – Indra
    Dec 19, 2015 at 16:47
  • I contacted the ISP over phone. There is nothing they can do from there. It is programmed that way.
    – Indra
    Dec 22, 2015 at 12:01
  • @IndrajithIndraprastham I am having the same problem. My ISP is also BSNL. I am on windows. Did you got any solution? Dec 31, 2015 at 6:30
  • @HardikPatadia Yes there is a solution. Remove default DNS option from your router and set 8.8.8.8 an 8.8.4.4 as your DNS. It will work fine.
    – Indra
    Dec 31, 2015 at 12:14
3

Check your router configuration at 192.168.X.Y, login and look for DNS servers setup, I had once some joker changing my DNS servers on my router because of my weak admin password, these DNS servers were resolving about 1/3 of my traffic to a certain page loaded with ads, rest of the traffic was resolved correctly. Bad guys also use this technique for phishing.

2
  • I checked all the router settings but couldn't find anything suspicious. Could it be something else? Dec 15, 2015 at 15:57
  • @ParagGangil Try another computer on the same network, if same happens to that computer, problem may be router, ISP, someone in the middle. ... , but if problem is only on your computer, you can focus on how is DNS resolved on your system.
    – Mike
    Dec 21, 2015 at 18:46
3

This seems to be what is known as ISP redirection, which is not uncommon. See https://en.wikipedia.org/wiki/ISP_redirect_page for more information. Quite a few ISP's have done this (I had it happen with Charter awhile back), and it's quite annoying. What worked for me was setting alternate DNS servers as another poster mentioned. You can also find how some others resolved it in the comments of this article: https://hackercodex.com/guide/how-to-stop-isp-dns-server-hijacking/

1

At first, please check your extensions enabled in browser and let us know if you find anything suspicious. Then check your search providers. After that check

 /etc/hosts

for signs of a redirection. Unfortunately Google does not have records which could clearly show cases similar to yours yet.

What did you do exactly before you started to experience this behaviour?

When I last time experienced something like that it was because of a tricky extension.

Armand

1
  • 3
    Well. I'd say, downvoting without any comment is not the wisest thing I can imagine. At that time when my comment was written the question was not well detailed, so there were the possibility for almost any type of 'attack'. Which ClamTK found as threat is a false positive, I'm sure. W/o any information I think no one can help. Whois shows hiren kakad as the domain owner (with an Axistel contact address). You can find his twitter profile then, which is full of spammy content. The most logical answer should be that OP mistyped URL then was redirected. We should know the prevalence in that. Dec 14, 2015 at 15:28
1

You could try setting an alternate DNS server in /etc/resolv.conf:

$ cat /etc/resolv.conf
nameserver 8.8.8.8
nameserver 8.8.4.4

The thing is that you are probably using DHCP, which will automatically assign a DNS server address to your computer. However, if your ISP's DNS server has been tampered with, it would be possible to do something like this. If this doesn't work, try using a VPN and see if that resolves the problem.

EDIT: Your ISP is probably doing something to your DNS. I suggest you use a VPN or contact your ISP. Your account may be capped. The real IPs for google.com

╰─ dig google.com

; <<>> DiG 9.9.5-9+deb8u3-Debian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55270
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     299 IN  A   196.23.168.172
google.com.     299 IN  A   196.23.168.185
google.com.     299 IN  A   196.23.168.170
google.com.     299 IN  A   196.23.168.158
google.com.     299 IN  A   196.23.168.177
google.com.     299 IN  A   196.23.168.157
google.com.     299 IN  A   196.23.168.155
google.com.     299 IN  A   196.23.168.162
google.com.     299 IN  A   196.23.168.173
google.com.     299 IN  A   196.23.168.166
google.com.     299 IN  A   196.23.168.181
google.com.     299 IN  A   196.23.168.143
google.com.     299 IN  A   196.23.168.151
google.com.     299 IN  A   196.23.168.147
google.com.     299 IN  A   196.23.168.187

;; Query time: 190 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Dec 18 10:48:53 SAST 2015
;; MSG SIZE  rcvd: 279
0

As explained by other answers, you problem is in DNS. DNS protocol is vulnerable to various attacks. The attacker does not have to be your ISP, it could be the router, anyone you share WiFi with, etc.

Therefore, it's highly recommended to use DNSCrypt, a better DNS protocol. Installation is quite simple.

sudo apt-get install dnscrypt-proxy

While you might want to use it together with an DNS cache for better performance. I found instructions in DNSCrypt ArchWiKi quite helpful.

0

This seems to be a common browser settings exploit (possible done by the "Ubuntu Modifications 3.2" plugin). See this article. Try installing another browser and see if you get the same behavior. If not, you should completely reset your Firefox settings, which should fix it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.