1

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page.

More specifically, when trying to load axdv-invalid-domain.com, I get redirected to uniregistry.com/buy-domains/axdv-invalid-domain.com?src=uniregistry-lander

This affects all HTTP clients. Even when I use the curl command line, a HTML page is returned.

This does not affect DNS lookups. Using the host command, I get "Host axdv-invalid-domain.com not found: 3(NXDOMAIN)"

My computer does not seem to have any VPN or proxy configured. I am using home wifi and this does not affect any other computers on the network.

How is this possible? Feels like I'm infected with malware but I can't figure out how the malware is doing this.

Improve this question
2
  • 1
    "My computer does not seem to have any VPN or proxy configured" - how do you come to this conclusion? This looks for me like a typical behavior with a proxy, where the name resolution is done at the proxy. Check the http_proxy environment variable when using curl. – Steffen Ullrich Jan 29 at 6:28
  • Try enabling very high verbosity for curl to see what it's doing in more detail. Also consider trying a non-http network client like nc/ncat, again with high verbosity, to port 80 on the specified domain and seeing what the handshake looks like. I'm guessing your organization or ISP is trapping unrecognized DNS queries, and your host command is just bypassing this. – CBHacking Jan 29 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.