1

Is it possible to redirect someone to a fake site without changing the hosts file? When I access a bank site, I receive a fake page. But my hosts file does not have any changes to do this. Is it possible?

5
  • The hosts file is just one way to impersonate a website; it is absolutely possible. That being said, are you sure you're receiving a fake page? If it has an invalid certificate, then I wouldn't trust it, but if the page just 'looks shady' your browser may not be parsing it right.
    – KnightOfNi
    Mar 7, 2015 at 1:05
  • 1
    Yes, it can be done on the network level with a man-in-the-middle attack. But why do you suspect that you are receiving a fake page?
    – tlng05
    Mar 7, 2015 at 2:26
  • 1
    highjack dns, dns cache poisoning, I've seen a few people swear they typed a url correctly (one letter off) and went to the wrong site, etc.
    – cutrightjm
    Mar 7, 2015 at 3:41
  • Yes, I'm Sure that i received a fake page. It's a fake bank site, all links are imagens, no certificate, and my bank sign down't match. I wrote the oficial domain. can i fix it? How? Mar 7, 2015 at 13:47
  • Since there are tons of possible causes, it will be difficult to provide any advice on fixing it without narrowing it down first. You may want to start with some basic stuff like running a virus scan and accessing the site from a different device, to see if you still get a faked page. If you can, try accessing the site from locations other than your house. Also, it would be nice if you could post a screenshot of the fake page, as that may provide some clues.
    – tlng05
    Mar 8, 2015 at 3:04

1 Answer 1

1

There are lots of ways besides editing the hosts file:

  • Your web browser got hijacked by some malware to request a different domain than you entered.
  • Your router got hacked. Remotely exploitable vulnerabilities in consumer-grade routers are not unheard of. Or you are using a public network which isn't trustworthy.
  • Your DNS server might be compromised. You can verify this by using a different DNS server like 8.8.8.8 (Google DNS server)
  • When you are using a proxy server, VPN or some anonymizer like TOR, that service might redirect you. When you are using such a service, try accessing the website directly. Check the network settings of your browser if there is any proxy server.

And these are just some which come to mind at first though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .