Level 3 DNS default response for invalid host names

Question

I was recently flummoxed by an issue related to me setting my router's static DNS servers to what I understand to be Level 3 DNS servers, (4.2.2.1, 4.2.2.2, etc.).

For work I use a company VPN. On the VPN are various hosts that I ssh into to perform various work related tasks. Sometimes my VPN client will drop my connection, rarely. When my VPN connection is up the client sets things up so that my computer uses the company DNS server to resolve hosts. When the VPN is down my router acts as my DNS server.

Let's say one of the hosts that I ssh into is called internal.server

Recently my VPN connection went down and I didn't notice. I tried to ssh into internal.server and I got a ssh spoofing error. The key in my ~/.ssh/known_hosts file did not match the key that was presented by internal.server

To make a long story short, I realized that the 4.2.2.1 etc. DNS servers (which get used when my VPN connection is down) resolve just about anything that's not valid to 23.202.231.167.

For example:

$ nslookup blah.blah 4.2.2.1
Server:         4.2.2.1
Address:        4.2.2.1#53

Non-authoritative answer:
Name:   blah.blah
Address: 23.217.138.108
Name:   blah.blah
Address: 23.202.231.167

I have no idea what 23.202.231.167 is, but they're running an ssh server on port 22.

And finally, my actual questions:

Why do the Level 3 DNS servers resolve (literally) blah.blah (and just about any other invalid.domain I can think of) to that IP address? Couldn't the host at 23.202.231.167 be doing all sorts of horrible spoofing things to people that made typos in their host names?

Am I missing something?

Answer 1

You have discovered the evils of DNS hijacking. ISPs and others hosting DNS servers started abusing DNS in this way years ago to direct end users to search pages when they try going to a website that doesn't exist by returning their own IP rather than NXDOMAIN. It gets them a bit of extra advertising revenue, but as you've seen it's particularly annoying for anyone doing anything other than normal web browsing.

Couldn't the host at 23.202.231.167 be doing all sorts of horrible spoofing things to people that made typos in their host names?

Absolutely. DNSSEC and DNS over TLS help here, but adoption is slow, and these won't fully solve the problem of typos anyway since typosquatters are the "legitimate" owners of their domains.

The best you can do is to configure your router or computer to use a DNS server you trust with DNS over TLS or DNS over HTTPS. Cloudflare (1.1.1.1) is a common choice as they helped kickstart encrypted DNS, and Google (8.8.8.8) and Quad9 (9.9.9.9) are other popular choices.