404 page taken over?

Keyser Sose · 01-06-2005, 09:07 PM

It seems that my 404 (Page not found) in all browsers has been taken over by this IP address.

66.172.91.184

Sites load as bigdemand.com or free-email.com

I am very unsure on how this has happened. It even shows up in PINGS, on a unknown host. Shows in every browser i have tried, to load an incorrect url

I run slackware 10, and failry experniced with linux.

Thanks!

scuzzman · 01-06-2005, 11:04 PM

If this is not hosted on your own computer, you'll need to take it up with the provider. If it is, check your httpd.conf for the 404 error, and see what it says. You also might want to run chkrootkit...

Keyser Sose · 01-07-2005, 05:53 AM

Yes, the site is not hosted on this box, I don't even know what it is. I ran chkrootkit, nothing was found. This does not have todo with apaches httpd.conf file? This site shows up browsing outside on the internet. say if http://linuxquestions.org is down, it will show that site instead. Kind of like spyware in windows

rjlee · 01-07-2005, 10:27 AM

This sounds like a “problem” at your ISP.

I guess (this is only a guess!) that they are running your proxy server? In which case, they are just looking at the status header from the HTTP server at the remote end, and redirecting in the event of a 404. Possibly they have a malware problem; otherwise, the site owners are probably paying them for hits.

Keyser Sose · 01-08-2005, 10:44 PM

No that has nothing todo with it. The other 3 comptuers in my house do not display that 404 page. 2 are windows, and one is a rarely used linux client, all network. Only this slackware 10 box is getting that instead...

scuzzman · 01-08-2005, 10:56 PM

Post the results of

Code:

cat /etc/hosts

Keyser Sose · 01-09-2005, 09:59 AM

Code:

#
# hosts         This file describes a number of hostname-to-address
#               mappings for the TCP/IP subsystem.  It is mostly
#               used at boot time, when no name servers are running.
#               On small systems, this file can be used instead of a
#               "named" name server.  Just add the names, addresses
#               and any aliases to this file...
#
# By the way, Arnt Gulbrandsen <agulbra@nvg.unit.no> says that 127.0.0.1
# should NEVER be named with the name of the machine.  It causes problems
# for some (stupid) programs, irc and reputedly talk. :^)
#

# For loopbacking.
127.0.0.1               localhost
192.168.1.191           linux.localhost.localdomain.com linux

# End of hosts.

Emerson · 01-09-2005, 10:10 AM

Do you run a web server in your slack box?

Keyser Sose · 01-09-2005, 11:35 AM

Yes. Apache2

Keyser Sose · 01-09-2005, 12:26 PM

Fixed it, seems that in my resolv.conf i had

search http://localhost.localdomain.com/

Which loads that bigdemand.com site...

So all is fixed