Advice please. https 192.168.0.10 shows IT support website?

This topic was created by Unbelievable! .

  1. Unbelievable!
    Big Brother

    Advice please. https 192.168.0.10 shows IT support website?

    I am a virgin media customer. I'm not sure if that bit bears any relevance, but I was messing around trying to get an old Watchguard

    Firebox x500 (which was being disposed of from work ) to work. I tried numerous addresses in my browser (Firefox) when I stumbled upon https://192.168.0.10

    First of all the browser said "untrusted certificate.. do you want to proceed?" or words to that effect. With shields up, I agreed and added it to the exceptions to see what was there, in what I thought was my local network.

    To my (not so great) surprise I got a redirect, it points to https://198.168.0.10/helpdesk/WebObjects/Helpdesk.woa which from the image, seems to be Gwynedd Mercy University. Wrongly or rightly I tried a few simple logins but obvious nothing works for me.

    the source of the page is curious, suggesting that it detects SHIFT or ALT keypresses?

    I asked a nearby friend (he's about 5 miles away) on Facebook to try the same address in his browser and he gets the same. He is also Virgin customer.

    Can anybody explain what this is please? Is this Virgin media related? What's the source code up to? Detecting keypresses makes me very suspicious...

    Screen shot: here: https://imgur.com/jRItfy8

    Many thanks for your advice and thoughts.

    Rob

    PS. Source code isn't allowed here is seems.

    1. Unbelievable!

      Re: Advice please. https 192.168.0.10 shows IT support website?

      Pooched dns i have concluded. .i didn't happen when it tried Googles 8.8.8.8 public dns.

      VM tell customers to use 194.168.4.100. Virgin media quickly changed it when i mentioned it on their forums this morning. http://community.virginmedia.com/t5/Networking-and-wireless/Dns-problem-Dns-poisoning-Or-just-normal-to-see-this-on-https/m-p/3107332/highlight/false#M102125

      No explanation or anything! but the page view count grew quickly. then i checked again and it (the wrong site) was gone.

      Begs the question how much of our traffic when through others servers due to buggered DNS entries i wonder? they have had others complain of poisoned dns before on those forums..

      1. Solmyr ibn Wali Barad

        Re: Advice please. https 192.168.0.10 shows IT support website?

        By default, Windows machines will try to register their IP & other connection details in the DNS. Then it's up to DNS admin - whether they do allow registration requests from workstations, and if they do, are those registrations allowed to propagate upstream.

        Looks like someone forgot their DNS wide open.

    2. jake Silver badge

      Re: Advice please. https 192.168.0.10 shows IT support website?

      Something is misconfigured on your end ... 192.168.0.10 is a non-routable IP address. It shouldn't redirect to anything outside your local network. See RFC-1918 ...

      Out of curiosity, why are you "not surprised" that it redirects to 198.168.0.10 (which indeed is owned by Gwynedd Mercy College)?

      1. Unbelievable!

        Re: Advice please. https 192.168.0.10 shows IT support website?

        198.168... might well be owned by gwynedd. but 192.168? why is the rerouting from 192 to 198. happening on local subnet? it has to be dns issue (194.168.4.100 is the dns specified by VM) this doesn't happen when i use googles 8's for dns. I'd be interested if anybody else with VM can give this a test please? Thanks for the replies btw: Jake and Solmyr ibn Wali Barad. I think that answers it. But would a large ISP be stupid enough to leave it open to allow upstream registration? The potential is .. immense!

        1. jake Silver badge
          Pint

          Re: Advice please. https 192.168.0.10 shows IT support website?

          "But would a large ISP be stupid enough to leave it open"

          Of course. "Large ISPs" hire LCD staff at minimum wage.

          THAT said, it's most likely a local configuration issue on your side of the network. Look for a typo(e) in the config files. Might be a pain in the arse to find. I recommend a beer (or three) at your elbow as you search, if allowed ;-).

        2. Solmyr ibn Wali Barad

          Re: Advice please. https 192.168.0.10 shows IT support website?

          If you're still curious, use nslookup and traceroute (tracert on Windows) on that address, maybe they'll shed some light at the issue.

          But whichever way we look at it, jake is still right - 192.168.x addresses are reserved for private networks and should not escape into the wild world. Somebody has seriously messed up.

          1. Unbelievable!

            Re: Advice please. https 192.168.0.10 shows IT support website?

            Things are looking mighty fishy with VM. the 192.168.0.10 issue is resolved, but guess what? since this post, my ability to access imgur.com is blocked somewhere!

            I can use a proxy or my mobile phone to see recent (a couple of hours old) stuff on imgur.com and also the original image i put up that i posted here. But none of several computers in any browser can connect via VM router/hub can. the hub itself has no blocking or domains or ips or anything i have set up. there is no other firewall or filter. Imgur is up and running fine.

            NSLOOKUP resolves to:

            C:\Users\Name>nslookup imgur.com

            Server: cache1.service.virginmedia.net

            Address: 194.168.4.100

            Non-authoritative answer:

            Name: imgur.com

            Address: 185.31.18.193

            when i use the VM modems own tracert it gives:

            <option value="2" />traceroute to (185.31.19.193), 255 hops max, 92 byte packets

            <option value="3" />

            <option value="4" />01 * * *

            <option value="5" />02 62.254.128.241 10 ms 10 ms, 10 ms

            <option value="6" />03 213.106.244.65 10 ms 10 ms, 10 ms

            ( brhm-bb-1c-ae4-0.network.virginmedia.net [213.106.244.65])

            <option value="7" />04 *

            <option value="8" selected />Traceroute FAILED.

            I had to view the source to because it wont it me copy from the hub interface. I inserted the dns for the last successful hop for clarity.

            Seems VM are a bit twitchy about something... ?

            1. jake Silver badge
              Pint

              Re: Advice please. https 192.168.0.10 shows IT support website?

              Again, config issues on your end.

              Beer, or three, at elbow might help.

              Sorry I can't be more helpful.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon