Level 3 are now hijacking failed DNS requests for ad revenue on 4.2.2.x | James's web home

As I was getting ready to leave the office today, I started to google for a movie to go to with my wife tonight. I’d been testing sites in chrome and firefox all day, so without thinking I typed my search term into the firefox address bar. What I got back astounded me:

Yep. Instead of responding with NXDOMAIN as a good DNS resolver should, it redirected me to their ultra-spammy “search page.” I’m running debian, so the chances of there being a virus are pretty low, and some research confirmed my suspicions:

jbert@vps:~$ dig cinetopia; DiG 9.8.4-rpz2+rl005.12-P1 cinetopia;; global options: +cmd;; Got answer:;; ->>HEADER
http://james.bertelson.me/blog/2014/01/level-3-are-now-hijacking-failed-dns-requests-for-ad-revenue-on-4-2-2-x/