Virgin hijacks empty pages Virgin broadband has started serving up advertising, instead of empty pages, when the domain you were looking for turns out not to be there. Users of Virgin's Broadband service have started seeing Virgin's "Advanced Network Error Search" instead of the traditional Server Not Found error when they enter a URL that doesn't exist …
Vm DNS has always been slow, so this just makes a crap service more crap!
I switched to Comodo Secure DNS . A fast and efficient service
http://www.comodo.com/secure-dns/
So much better then VM. And unlike OPEN DNS no Adverts to opt into.
VM After the PHORM disaster you should have known better then piss your customers off once again.
" The trick isn't new: Comcast, Verizon and several other US ISPs already insert their own messages when users try to contact a non-existent server. But it's the first time we've seen it on this side of the pond"
A couple of members of my family are on Orange broadband and this has been happening for at least a year on their service, and it's not a branded help page, it's just a straight up search engine result crammed with advertising fed by orange/google.
This post has been deleted by its author
Deutsche Telekom started this over here on the right side of the North Sea some months ago.
The opt-out instrcutions were on the returned page so I only saw it twice and forgot about it. Not that I minded the ads since my brain filters them automagically, but it really screws up the auto-complete in my browser.
Don't mess with standards, ISPs. Some people actually use them as intended.
Get your facts correct, this isnt the first time that an ISP has done it on 'this side of the pond' - check the register for previous stories (keyword typo). It wont be the last time either.
I would rather my ISP gets the PPC on this activity over all the other embedded fraudsters which currently hijack my errors..
I can already hear the comments coming - lets all use OpenDNS!! wait a minute there whole business model is built on NXDOMAIN hijacking!!
How can replacing NXDOMAIN with resolvable IP's be classed as hijacking? there is no ownership of something which doesnt exist, or is the ERROR yours???
If you all want the really useful browser error (ffs) then opt out!
typed in a silly url and found the opt out link after the first sentence, I wonder how many people are going to accept it as just a normal part of what the internet "does"? I >pay< them for access to the internet, not for them to mess with the internet... or cram unwanted ads upon me via the service I'm >paying< for.
Anyway, I've opted out now so it makes no difference... plus pretty pleased with the free upgrade to 10mb so I'm not going to complain too much!
After the "www.nottheregister.co.uk" example of the first screenshot, the reader would be forgiven for assuming that the second screenshot was what Virgin's add-site - sorry, "helpful assisted search tool" - serves up in response to the same address.
In which case, having the top two links return links to Virgin Media would, indeed, be a laughably-obvious attempt at self-promotion.
However, the URL typed for the second screenshot being "www.virginmedia.CMO", the links shown are, in fact, the most useful links it could have provided.
In other words, a laughably-obvious attempt at producing an amusing screenshot.
I have a little script on my "linux server in the hall cupboard" that I use to check the current server some domains are on (we just moved server and a few are still on the wrong box)
The script uses the PHP gethostbyname function to get info on a domain
I've switched off Virgin's DNS hijacker
Anyway, I just added the non-existant qweasdzxc.co.uk to the script and got this back
82.7.250.238
www.qweasdzxc.co.uk
82.7.250.238 is owned by Virgin - I should be getting an error, not an IP!
They do this already, in fact they're the reason I ditched them after giving up on TalkTalk's own DNS servers (which kept killing my router?!). If a page doesn't exist I WANT to know, not get some 'helpful suggestions'.
I eventually ended up using a selection of 4.2.2.1 - 6, which are widely known and used on the Internet...
I love new toys :)
Find any domain that contains the letters sex as part of the domain and give it a go - what a laugh!
I tried going to http://www.myessexstore.com - presumably a store that sells gifts from the county of Essex
Virgin will happily direct me to all kinds of pornography but not to anything related to Essex
Even more worryingly if I go to www.essex-babies.co.uk or www.essex-schools.co.uk I get a few meaningful(ish) results plus all the porn links at the bottom
"Advanced Network Error Search
Our advanced network error search helps us make money from you even more quickly.
You all make mistakes when you type in website addresses, because, quite frankly, you're all morons. Perhaps you miss a few letters, or the website doesn't exist any longer. Well that's good news for us! If an address you enter doesn't locate a site, this handy feature will convert the incorrect address into even more money for us, so instead of an error message you will get a list of our highest-paying advertisers, plus some completely useless additional unrelated links.
The advanced network error search is currently switched OFF.
To change your selection, use the buttons below:
Yes - I would like Virgin Media to take the piss out of me even more than they do already
No - I would like the internet to work in the way it was intended, complying with net standards and not breaking programs that I may use which need the internet to function properly."
Paris - because she'll do anything for money too.
I wish people would think before they post coments suggesting other DNS providers on here.
Both OpenDNS and SecureDNS show the same type of page with adverts when a domain name has no corresponding IP.
The only quarm I ever had with VirginMedia DNS is that it seemed to take forever to update......
Took two weeks once to update my domain...
It isn't just the ISPs who are doing this hijack. Grisoft's AVG anti-virus has sold out to Yahoo in some very weird ways. Not only have they rammed a Search Tool into their security toolbar (which cannot be removed), but they also have added this same "feature" for typos.
It would be interesting to know which takes precedence over your typos - AVG-Yahoo or the ISP.
(I use OpenDNS didn't see this "feature" get enabled on my Virgin Broadband connection. And AVG was removed they day they started letting Yahoo at my data. In Free software that was fine, but in a Paid For version of a Security product it fails to make any sense)
Now the cat's out of the bag, like spam, this isn't going to stop. The exec's at the top of ISPs won't understand what the issue really is - they can only see the internet as the web and think this is a great idea to make money from <ahem> I mean "help" the users.
So DNS needs to come up with a 3rd way - a response that includes a NXDOMAIN but also an address of a "useful server" to redirect some protocols to.
Not got it here on my Virgin Media connection, just times out.
But then I am running my own DNS on my server too which looks at OpenDNS alongside Virgin Media. What does annoy me is when OpenDNS helpfully comes up with a search when it thinks a site is down, not very helpful when the timeout appears to be less than a second. A quick refresh and bang, the correct site appears.
By the way, www.nottheregister.co.uk now points to a holding site which says "Greetings to El Reg.".
By the way, if you have something like the GOD AWFUL AVG toolbar installed (which always hijacks the search to Yahoo even if it's configured not to, and then re-enables itself even if you disable it) it will also open up an AVG/Yahoo Search when it can't find what it's looking for.
With all this crap going into AVG (nag screens every week or so to 'upgrade', slow performance and now this toolbar shite) I'm tempted to look elsewhere for anti-virus software (might even give ClamWin a try).
Rob
RE: Anonymous Coward,Tuesday 18th August 2009 10:19 GMT
Hijacking NXDOMAINs can be a real nuisance for users of most VPNs. In order to reduce traffic hitting the VPN's DNS server, the normal proceedure for looking up a host is the following:
- Lookup dns for 'serv1.company.local' on ISP's DNS server
- Receieve NXDOMAIN from ISPs DNS server
- Lookup dns for 'serv1.company.local' on VPN's DNS server
- Receive IP, connect etc.
that way, global DNS entries are looked up on the ISP's DNS server and does not hit the VPN for extra traffic, unless the global DNS cache doesn't know of the server, then it trys the VPN DNS server.
With NXDomain hijacking, this is not possible as the ISP does not return NXDOMAIN for serv1.company.local and the VPN's DNS is never queried. Company email/intranet is effectively blocked by the ISP.
There've been a few comments on this thread, and the other story along the lines of
"I'd prefer Virgin got the PPC than the Scum who place ads on mis-typed domains"
Just to point out, this makes no difference to those people. If you type Verminmedia.com and someone has registered that address and placed ads on it, guess what, there'll be a valid DNS record and you'll still land on that persons parking page.
All this does is increases the likelihood of a typo serving you ads.
Oh and buggers and applications that rely on DNS accuracy. Bad, bad idea. But at least it appears they are Opting out at a network level rather than relying on cookies!
Surely if you mis-type the URL for a company and get an ad for rival, that's a scenario for long costly and pointless litigation by corporations who feel their trademark has been infringed. After all, if fat-fingered people try to type Nokia's URL, mess it up, and get redirected to Samsung then Nokia may have a case for passing off or trademark infringement or something to waste everybody's time and money in court. Enterprising lawyers have already sued Google over something similar but even more meritless:
http://www.wired.com/threatlevel/2008/10/google-profitin/
1: It's trivial to opt out and the opt-out uses the (presumably MAC) address of your modem as an identifier - you opt out the modem your whole home network is opted out; a much better opt out than cookies... read the blurb on the VM website.
2: VMs DNS servers have been shit for a while - I deliberately opted for OpenDNS, which does exactly the same ad displaying, for the improved responsiveness.
3: AFAIK, as far as Virgin are concerned, this only affects Virgin Media NOT their NTL business arm. VM is a service for home users, bit of YouTube, bit of WoW, email and eBay - and so long as VM are only hijacking 404s rather than say 502s I can't see this having a massive negative effect on home internet usage.
Yes, OpenDNS does exactly the same thing, the difference is if you use OpenDNS then you requested that rather than had it foisted upon you.
It also means your ISP which you're already paying a monthly charge to isn't milking more money out of you but this time without your permission through ad revenue.
.....The first advert is for VM broadband. WTF??? The user is already saddled with VM broadband if they are seeing this. What's more, the user will be reminded of the crappy deal their stuck with and have to look at the latest offers for new customers only!!
Ah well, if the user is still using IE6 then this is the least of their problems....
I was surprised to see this appear on my housemate's computer, on the cusp of a tirade, I first checked on my own computer. I still get the firefox "server not found" error. We're still "opted in" according to the virgin page.. I'm just that awesome.
For all you talking about 404 errors, 404 is when a file or directory is not found on a server, but a 404 error is something returned by a server, so if the server isn't there, you can't get a 404.
Another thing, there's no point in saying this either, because you won't read it but how many comments have said the same thing about tiscali/orange? It's a bit ironic that you're all telling El Reg that they missed out on previous stories of this nature.. but some of you missed out on previous comments, right here in front of your eyes, saying the same thing.
Yes adverts on web page = bad. Such adverts mind-control anyone seeing them to buy stuff they never wanted in the first place.
I, for example, now find myself inexplicably craving a Blackberry Curve 8520 when only two minutes before I was unaware of the rather self-indulgent model-naming conventions of RIM products, and am desperate to read several "white papers" on subjects I have absolutely no interest in whatsoever.
The Register should remove these insiduous mind-control adverts from their pages at once before someone gets hurt.
Then they can preach at Virgin for being evil.
As Virgin can control where I go unless I run my own DNS (can't be bothered - hosts does it nicely for me) it makes me think...
As Virgin (and others) are deliberately sending me somewhere I don't want to go they have 'infected' my computers with unwanted advertizing (aka Spam)
I wanted to go [nowhere], they sent me to [a spam page]
Whilst they have not downloaded anything onto my PCs they have changed the operation of my equipment without my prior consent or approval
A friend was, a few months ago, infected by one of those pretend virus removal packages (idiot). The thing wouldn't let me change DNS back to the proper setting as it wanted to hijack the real DNS to divert any attempt to get rid of it to more demands for money.
Is this not, in essence, a similar act, albeit on a more benign scale?
Simon, VM are monitoring the comments on this and other boards. The address your test returns is NOT the VM "search" page, but is actually a VM customer PC address (in the Manchester region).
If you could report this issue on
http://www.virginmedia.com/myvirginmedia/advancederror/feedback.php
I can ensure you that it will be investigated and you will get a response.
OK, have opted out, but this idea is fundamentally wrong. I wish the slimy admen would leave well alone with my private communications.
With this system you get the feeling that someone is always looking over your shoulder, waiting for you to make a mistake so they can sell you some snakeoil.
Odd - not all sites return the offending page; nws.bbc.co.uk did the standard browser page load error.
Also, adbocker plus seems to kill the adverts anyway; when I tried the myessex.com it showed some 'did you mean's but no links.
Aye well, 'tis allegedly turned off, now. And they have a very polite rude letter.
LOL i got directed to this advertising page
they clearly know the URL was ment for theregister.co.uk
perhaps you can claim your loss of earnings for their commercial redirection for profit scam....
----------------------------------------------------
http://www.geekinter.net/
GeekInter.Net - Free stuff for geeks
Ask if you dare free@,,,,
Greetings to El Reg.
(No I'm not an "enterprising company". Just me doing stuff for free.)
http://www.stonewall.org.uk/images/cm_images/donate/stonewall_grey.jpg
"petard hoisting #
By Dennis Posted Tuesday 18th August 2009 10:20 GMT
Luckily I'm not a customer of Virgin Media.
But has anyone tried the trick of editing the hosts file and adding an entry
127.0.0.1 advancedsearch.virginmedia.com
Is there a real use for this web site or is just an adman's wet dream?
"
interestingly, their usual serch page is using Google powered http://www.virginmedia.com/search/
wereas that URL "advancedsearch.virginmedia.com" (entered in a blank web tab)
i didnt even realise existed or does it ?, i suspect its also being redirected to here
http://advancedsearch.virginmedia.com/subscribers/assist?url=advancedsearch.virginmedia.com
"search results powered by YAHOO!"
"Sorry! We could not find advancedsearch.virginmedia.com
It may be unavailable or may not exist. Try using the suggestions or related links below, or search again using our web search.
"
so their being nice to Yahoo getting your redirected searchs, and perhaps VM get some form of mony incentive into the bargin, being No2 in the uk consumer ISP market perhaps.
typing "advancedsearch" in the page Does still give you "This program cannot display the webpage" though, put a www. infont of it gets you the VM banded yahoo search too.
"Calm down dear... #
By tim 73 Posted Tuesday 18th August 2009 13:19 GMT
...it's just a commercial.
"
is it though, VM sales will probably be collecting the redirect data and Your response clicks to it, (if your not web tech with an add blocker installed), and selling that data and your sudo annonimised data flows on to Non UK 3rd partys.
and/or the credit reference agencys to add to your ever growing annon online wired and wireless mobile CRA profile, some day soon that data wil come back and make you pay a higher interest rate at the very least.
remember their current wall sitting on Phorm, or Bt's internal badged phorm pages servers being in reality phorm servers in the US and elsewere,
i may use them but i DONT trust them after all the fence sitting and stated intent to monitise My dataflow content property etc, and neather should you after you give this a little more thought than your mere "...it's just a commercial", and consider how it could effect you and your familys income and credit reference etc if you let them mission creap like this.
commercial jobswerth: ill just add one more item here, they will never notice as we have brainwashed them to accept almost anything without thinking and all we need do is give them a brand new official Virgin media web messageboard to go vent on and forget the real problem we exploit at every turn for the good of the company and the boardroom.
This is, lets face it, something that the average human user can understand. Google will suggest an alternative for an obvious typo.
And this is going to screw with a lot of machines.
But what happens if you mistype a server name in a non-http connection?
Maybe the answer for the people doing automatic stuff is to stop using http for querying domain names. Send the query for the IP address as if it is from an FTP client, and if it comes back OK, have the http start with that IP address, rather than a domain name. Or am I totally misunderstanding what goes on?
I mean, sure we dont want this, but most normal users would find this useful, my dad for example finds this great!
Also if it gives them a bit more revenue it might keep them away from Phorm for a bit longer.
As for opt-out/opt-in, i think opt out gives users who are not techies the chance to use the service and us techies a way out.
I know that most people would not know how to opt-in to anything!
and that opt out is not working at the moment
i am a virgin media customer, but when i tried to go to the link this article posted i was REDIRECTED to a page which said it did not recognise i was a virgin media customer, and to try again later
<https://my.virginmedia.com/advancederrorsearch/hitch;jsessionid=EAD4C783F0452A82CECBE118AE6FA175>
Can't see why someone would avoid domain hijacking by using a commercial service built on such hijacking.
Sensible people use
4.2.2.1
4.2.2.2
Those work properly, anywhere (they're routed to a nearby server so you don't end up crossing the atlantic to do DNS lookups) and also are a heck of a lot easier to remember.
Peter, it sounds like you are a VM National (ADSL) customer. At present the new system is not rolled out to those customers.
ADSL customers will be able to opt out as soon as the system goes live on ADSL some time in the next month or two, but until then the opt out link will not work.
The optout system will return the message you saw if it is accessed from any non-VM Ip address as well.
Thank you for the reminder! I had almost forgotten to switch my dns back to http://www.opendns.com/. Since the brand changed to virginmedia the money grabbing & BT style tactics have begun. Try adding the word arse to a url and you are now greeted by adverts for sex toys etc! Great stuff virgin!
AC> "
ADSL customers will be able to opt out as soon as the system goes live on ADSL some time in the next month or two, but until then the opt out link will not work.
"
I noticed we weren't getting the advanced network search page on the day this was reported, but it has kicked in since.
It would be nice if they checked the user agent to see whether the page might actually be sent to a pair of human eyes, but since they don't I've disabled it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
