1

Here's a very strange thing I've noticed happening.

At a clients facility, on one of their wireless networks, I can successfully ping "gibberish" DNS addresses without any suffix.

In other words, I can write ping asdhkahsdkjaskdjska and it'll resolve.

C:\ping sdlkjaksda

Pinging e11547.dsca.akamaiedge.net [104.81.229.154] with 32 bytes of data:
Reply from 104.81.229.154: bytes=32 time=20ms TTL=60
Reply from 104.81.229.154: bytes=32 time=19ms TTL=60
Reply from 104.81.229.154: bytes=32 time=19ms TTL=60
Reply from 104.81.229.154: bytes=32 time=19ms TTL=60

Pining a gibberish address which contains a suffix (like the above, but with added .com at the end) produces the expected result of the ping / address resolution to fail.

This only seems to happen on my machine, however, and only on one of the two wireless networks the client has.

I've no idea what this could be - I can't tell if my machine is infected, or if the problem affects machines not registered in the clients domain... or anything else. I feel like this probably isn't a virus on my machine, since it seems a bit too targeted - the issue doesn't exist when I'm at home / at work, only in this one specific network belonging to one of my clients. On the other hand, the target IP belongs to a content delivery service / cloud service of some kind - those are often used to deploy malicious content... but on the other-OTHER hand, that IS one of the largest content delivery networks on the planet, so...

Also, I've tried to narrow the problem by using nslookup in Windows, but that instantly fails and yields no further clues as to what is happening.

What could possibly be happening here?

EDIT: Further inspection revealed it's not just on my laptop. Other machines (albeit not all) in this network also resolve bogus DNS addresses to the same IP. So it's definitely not anything on my machine.

  • It might be your ISP intercepting DNS. See How to Stop Your ISP from Hijacking Your DNS Servers. – Steffen Ullrich Apr 6 '17 at 13:27
  • @SteffenUllrich I can't be sure, but I somehow doubt that's the case. First, nslookup failed, while pings worked. Secondly, it only "resolves" the names with no suffix or a non-standard suffix (like somethingbogus.bogussuffix). If I try to resolve bogusdomain.com it'll correctly fail to resolve it. – Shaamaan Apr 7 '17 at 7:46
  • In this case it might be that the nameserver for your local domain has a wildcard for internal names: just querying hostname will result in the actual query of hostname.yourdomain which will be answered by the nameserver for yourdomain. Asking hostname.domain instead will be forwarded to an external nameserver. – Steffen Ullrich Apr 7 '17 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.