5

I typed a URL in Safari to check whether a domain name had been registered or not, and was redirected to this page:

enter image description here

(here I made the test with "http://fegiuebnfuybzh.com", a random string of letters and a domain I believe no one owns).

The URL I was redirected to is:

http://searchguide.level3.com/search/?q=http%3A//fegiuebnfuybzh.com/&r=&t=0

I couldn't find much recent information about this website, and I definitely never gave my computer access to this service knowingly.

I can see that the home page has a "settings" link:

enter image description here

I do not want this service to be present in my computer at all, even with "off" settings, so this aren't what I'm looking for.

How can I make Safari display the regular "the address couldn't be found" text page, and get rid of this nasty "level 3"?

Improve this question
2
  • 1
    Think you have a virus. Install MalwareBytes Anti-Malware and run a sweep.
    – JMY1000
    Commented May 29, 2016 at 19:04
  • 3
    Sometimes, ISPs will insert that kind of structure for 'not found' URLs - mine does occasionally, though it didn't for that random URL. Level3 is not a suspicious domain in itself, so the redirect may be entirely innocuous.
    – Tetsujin
    Commented May 29, 2016 at 19:37

4 Answers 4

Reset to default
6

One reason could be that you are using Level3’s DNS servers (4.2.2.1 through 4.2.2.6) which will redirect you to their search engine for any unknown domain name.

Change it back or choose one of Google's public DNS server, for example 8.8.8.8

Found this answer here

Improve this answer
3
  • This is the correct answer
    – Taha Jahangir
    Commented Dec 5, 2016 at 5:56
  • @TahaJahangir Not for me, it isn't. I have OpenNIC resolvers but I still get the stupid Level3 search guide.
    – Hack-R
    Commented Sep 2, 2017 at 21:15
  • @Hack-R You ISP may intercept DNS queries (regardless of destination IP), and replies them with this malformed responses
    – Taha Jahangir
    Commented Dec 26, 2017 at 9:51
4

Investigate whatever your ISP provides to turn off NXDOMAIN redirects. This has nothing to do with your computer.

Improve this answer
1
  • Thanks! Could you explain how I can investigate your solution? Through the modem's settings? By calling the ISP?
    – MicroMachine
    Commented Jun 25, 2016 at 20:33
1

You should be able to get back the regular "the address couldn't be found" text page after removing level3.com from the smart search function or completely disabling this feature:

  • Open Safari > Preferences > Search

    enter image description here

  • Click Manage Websites…

    enter image description here

  • Either remove level3.com or all websites listed

  • Or disable Enable Quick Website Search completely
  • Restart Safari
Improve this answer
1
  • Thanks for the answer! There were indeed websites in this list I hadn't authorized... but no Level3. Any idea how websites get added to this list?
    – MicroMachine
    Commented Jun 25, 2016 at 20:33
0

The reason why you're being redirected from some non-existing domain address to Level3 Search engine pages can be related to your DNS configuration or your ISP provider settings.

For example when using free DNS servers such as 4.2.2.1 (up to 4.2.2.6), normally they're used to locate the nearest DNS resolvers (especially useful for slow networks). See: What is 4.2.2.2? However please note these IP addresses are owned by Level 3's network, so they are basically redirecting you to their own search engine in case the domain is not found, because you're using theirs DNS. If you don't want to be redirected, simply don't use their DNS.

To check which DNS are you using, you can check in /etc/resolv.conf or in Network Preferences of your connection.

Here are simple *nix shell command lines to check:

$ dig non-existing.domain
        ︙
;; ANSWER SECTION:
non-existing.domain.    10  IN  A   104.239.213.7
non-existing.domain.    10  IN  A   198.105.254.11
        ︙
$ wget -qO- http://104.239.213.7
<html><head><meta http-equiv="refresh" content="0;url=http://searchguide.level3.com/search/?q=http://104.239.213.7/&t=0"/></head><body><script>window.location="http://searchguide.level3.com/search/?q="+escape(window.location)+"&r="+escape(document.referrer)+"&t=0";</script></body></html>

So the redirect happens on DNS level by resolving any non-existing domain to Level3 pages.

To find out which DNS is redirecting you to Level3 pages, run this *nix command:

$ dig non-existing.domain | grep SERVER
;; SERVER: 4.2.2.1#53(4.2.2.1)

If you don't want the redirect to happen, change your free DNS to the one which ISP is providing for your network, or to your local DNS such as gateway/router IP.

Alternatively use different public DNS servers (which doesn't belong to Level3) such as:

  • Google Public DNS: 8.8.8.8 and 8.8.4.4
  • OpenDNS: 208.67.222.222 and 208.67.220.220
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .