0

Today I was greeted by this error in Firefox:

error

It was happening consistently for a minute or two, and reverted back to normal. I confirmed that it happens on another browser and that other HTTPS sites open up properly. I wasn't able to check what happens on other devices on my network before it went back to normal, however I did ssh to another machine outside of my local network and attempted to curl google.com (all OK).

I'm on a home network behind a NAT using a wireless router (Cisco EPC3928) that my ISP (Vectra, PL) is remotely controlling.

What are the possible causes for what I'm observing? I don't suspect it's Google's fault.

I wasn't able to find any info about the domain xn--ngstr-lra8j.com that shows up in the cert.

3
  • xn--ngstr-lra8j.com is owned by Google according to WhoIs.
    – schroeder
    Apr 4, 2017 at 8:58
  • Googling that domain name shows that this is perfectly normal, and in fact, firefox users have reported similar issues over the years.
    – schroeder
    Apr 4, 2017 at 9:00
  • Xn-- is the prefix for punycode, for internationalized domain names. You can translate it using an online website. Those can be another layer of obfuscation unfortunately.
    – munchkin
    Apr 4, 2017 at 15:02

1 Answer 1

1

EDIT: I am leaving my previous answer for people who wonder about the same question but without the exact same symptoms. However, I have made a mistake. This is not an attack, it is simply an error. The URLs in question are legitimate and this problem is widely known. Thanks to schroeder for pointing that out in a comment.

Previous answer:

There can be several reasons for what you are seeing, to name a few:

  1. There appear to be some vulnerabilities for the router you have. Since you mention your router is being managed by your ISP, I don't find it hard to believe that your router is not completely up to date. So It is possible that your router has been exploited remotely, and is now trying to redirect you to malicious sites (googlevideo.com instead of google.com, for example).
  2. Someone has infiltrated your network in some way and is now trying to redirect you to a malicious site using DNS poisoning.
  3. An attacker has modified your host file locally to redirect google.com to another IP. This is possible through compromising your own machine.
  4. Some technical error that is not malicious, or has not originated from your network (for example, an error with your ISPs DNS server).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .