0

I'm on a RHELx64 7.3; I Do Not have nginx installed.

Why is it when I curl badsite.cooo I get an nginx response?

$ curl badsite.cooo
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>

At first I thought maybe that was Google, but that sounds absurd. Is that my ISP then, or what? I have some assumptions; is that my DNS server box? Also I have lighttpd, and php55w, and fast-cgi, is it one of those?

$ curl -v badsite.coooo
* About to connect() to badsite.coooo port 80 (#0)
*   Trying 198.105.254.114...
* Connected to badsite.coooo (198.105.254.114) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: badsite.coooo
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Thu, 02 Feb 2017 09:00:32 GMT
< Content-Type: text/html
< Transfer-Encoding: chunked
< Connection: close
< Location: http://localhost
< Expires: Thu, 02 Feb 2017 09:00:31 GMT
< Cache-Control: no-cache

Edit, wait that's me??

$ traceroute google.com
traceroute to google.com (74.125.28.101), 30 hops max, 60 byte packets
 1  router.ld.pvt (192.168.1.254)  0.866 ms  0.837 ms  0.814 ms
 ...
 ...

??

ld.pvt is me, whats router.? Not sure what that subdomain is; I have all kinds of services I've been getting setup here for php, but I still don't recognize the subdomain.

  • 1
    Some ISPs have a bad habit of showing a special page for domains which they couldn't resolve. Add output of curl -v basite.cooo – muru Feb 2 '17 at 8:59
  • added traceroute also thought about this, and looks like when i installed the server, i chose bind, makes sense in hindsight, is this bind then though?, $ which named /sbin/named. Whats this in nmap? 111/tcp open rpcbind is that it? Note, i also thoroughly searched for the response string, as well as nginx configs, they are non existent. – Brian Thomas Feb 2 '17 at 9:06
  • ok i must be mixed up, sorry, its late, thats my router, and i shoudl have traced to badsite... ` traceroute badsite.cooo traceroute to badsite.cooo (198.105.254.114), 30 hops max, 60 byte packets. ` – Brian Thomas Feb 2 '17 at 9:11
1

This is from the Frontier ISP, and it is pretty much search and advertising DNS. This info was dug from here, particularly this part

It appears that localhost.localdomain was resolving to 198.105.254.114, some advertising search site that my ISP (frontiernet) was putting in their nameserver and returning for any unresolvable DNS query that resembled a FQDN.

$ nslookup localhost.localdomain
Server:         192.168.1.254
Address:        192.168.1.254#53

Non-authoritative answer:
Name:   localhost.localdomain
Address: 198.105.254.114
Name:   localhost.localdomain
Address: 198.105.244.114

So if you curl a site that has to be searched, it hits the ISP DNS, which in this case is returning a 301 moved permanently, not the most accurate answer, since it never existed in the first place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.