Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The first time each day that I attempt click on the 'Mail' link from the Yahoo home page, my browser (Seamonkey) throws up a dialog with the title 'Secure connection failed'.

The content in the dialog reads - uses an invalid security certificate
This certificate is only valid for

Error code: ssl_error_bad_cert_domain

(if somebody could guide me, I'll attach the certificate from dnsadvantage here)

I have no idea why is entering the picture ... instead of going to the target URL

After I cancel the dialog, the page continues to load but now shows the certificate for Yahoo.

I'm concerned somebody may be trying to retrieve the credentials for yahoo.

Why does the browser present the certificate from instead of

share|improve this question
up vote 8 down vote accepted

The deal is that is being used as at least one of your name servers and had a failed dns lookup (oops). dnsadvantage provides free DNS lookups in exchange for doing a MITM attack for domains that it cannot find. The page that it serves for these failed lookups is and it displays google ads.

So try going some domain that doesn't exist like, and you should see a dnsadvantage advertisement. If you don't, then only one of your DNS lookup servers is from dnsadvantage, so you might only see an ad on ~1/3rd of failed dns lookups.

share|improve this answer
And: don't click through the warning! You may see this the first time each day because the address for the site you are trying to visit is not in the DNS cache. Refresh the page until you get to the right place. (Unfortunately, since these kind of DNS services don't follow standards, your browser/resolver may cache the response (for 10 minutes) so you may need to restart your browser and/or wait until the bogus response's TTL expires.) – bstpierre Dec 22 '11 at 13:02

Chances are an advertisement is trying to load and it's getting redirected to the given URL which has the wrong certificate set up.

You could try using wireshark or fiddler to figure out what is connecting to the URL. You could also open the page source and search for ''.

share|improve this answer
Good idea. Just ran a search in the page source for but no results – Everyone Dec 22 '11 at 4:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.