Todos os hosts inválidos são resolvidos para “com.org”

Question

vi@vi-server:~$ nslookup nonexistent.itransition.com
Server:         8.8.8.8
Address:        8.8.8.8#53

** server can't find nonexistent.itransition.com: NXDOMAIN

vi@vi-server:~$ cat /etc/resolv.conf 
nameserver 8.8.8.8

Não existe. O mesmo resultado de dig nonexistent.itransition.com .

vi@vi-server:~$ ping nonexistent.itransition.com
PING nonexistent.itransition.com.org (216.234.246.153) 56(84) bytes of data.
64 bytes from 99.f6.ead8.static.theplanet.com (216.234.246.153): icmp_seq=1 ttl=46 time=128 ms
64 bytes from 99.f6.ead8.static.theplanet.com (216.234.246.153): icmp_seq=2 ttl=46 time=128 ms

Ele pega todos os nomes de host inválidos? Por quê? Como prevenir?

Saída de Strace:

$ strace -s1024 ping nonexistent.itransition.com
execve("/bin/ping", ["ping", "nonexistent.itransition.com"], [/* 18 vars */]) = 0
...
socket(PF_INET, 0x802 /* SOCK_??? */, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
...
send(3, "0
vi@vi-server:~$ nslookup nonexistent.itransition.com
Server:         8.8.8.8
Address:        8.8.8.8#53

** server can't find nonexistent.itransition.com: NXDOMAIN

vi@vi-server:~$ cat /etc/resolv.conf 
nameserver 8.8.8.8
vi@vi-server:~$ ping nonexistent.itransition.com
PING nonexistent.itransition.com.org (216.234.246.153) 56(84) bytes of data.
64 bytes from 99.f6.ead8.static.theplanet.com (216.234.246.153): icmp_seq=1 ttl=46 time=128 ms
64 bytes from 99.f6.ead8.static.theplanet.com (216.234.246.153): icmp_seq=2 ttl=46 time=128 ms
$ strace -s1024 ping nonexistent.itransition.com
execve("/bin/ping", ["ping", "nonexistent.itransition.com"], [/* 18 vars */]) = 0
...
socket(PF_INET, 0x802 /* SOCK_??? */, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
...
send(3, "0%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncom%pre%%pre%%pre%"..., 45, MSG_NOSIGNAL) = 45
...
recvfrom(3, "013%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncom%pre%%pre%%pre%0%pre%%pre%%pre%%pre%0%pre%;ns1\fworldwidednsnet%pre%it@itransition0$w6.%pre%%pre%T'%pre%%pre%*0%pre%\t:0%pre%%pre%00"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) send(3, "6c%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%"..., 49, MSG_NOSIGNAL) = 49= 116
close(3)            

# Why it tries .com.org after that?
socket(PF_INET, 0x802 /* SOCK_??? */, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
...
send(3, "6c%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%"..., 49, MSG_NOSIGNAL) = 49
...
recvfrom(3, "6c10%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%0\f%pre%%pre%%pre%%pre%\f4%pre%0261"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 65
close(3)
%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncom%pre%%pre%%pre%"..., 45, MSG_NOSIGNAL) = 45
...
recvfrom(3, "013%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncom%pre%%pre%%pre%0%pre%%pre%%pre%%pre%0%pre%;ns1\fworldwidednsnet%pre%it@itransition0$w6.%pre%%pre%T'%pre%%pre%*0%pre%\t:0%pre%%pre%00"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) send(3, "6c%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%"..., 49, MSG_NOSIGNAL) = 49= 116
close(3)            

# Why it tries .com.org after that?
socket(PF_INET, 0x802 /* SOCK_??? */, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
...
send(3, "6c%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%"..., 49, MSG_NOSIGNAL) = 49
...
recvfrom(3, "6c10%pre%%pre%%pre%%pre%%pre%%pre%\vnonexistent\vitransitioncomorg%pre%%pre%%pre%0\f%pre%%pre%%pre%%pre%\f4%pre%0261"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 65
close(3)

    

Answer 1

Experimente o ICSI Netalyzr . É um aplicativo Java que pode testar sua conexão com a Internet em busca de sinais de problemas. Seu ISP pode estar redirecionando suas pesquisas de DNS para seus próprios servidores para vender anúncios ou por algum outro motivo.