"You are here by accident" Message

[Andrea2255]

We started receiving the warning message a couple of days ago. When we try to access the internet we get a warning message that says "You are here by accident It has been brought to our attention that the IP address of this server (205.209.153.162) is being used as a local DNS resolver by a cable or broadband provider somewhere. This is a mistake because this server reports the same IP for all queries for an internal application that has nothing to do with you. You need to contact your access provider (whoever they are) and get proper DNS resolvers from them."
We are running Windows 2000 server. We have a DSL internet connection. I have contacted the provider and they have no idea what to do or what this is. We have about 40 computers (XP) on the network and every computer gets this message at random. They may be able to access google and the next time they can't or vice versa. When IE produces the error, I can ping the name and get an IP and reply. We have Norton antivirus and I haven't noticed anything there, no firewall issues. It's just so strange that it's random and it makes me think that it is an external dns issue. We haven't made any changes to our internal network. Thank you in advance for any help, I am completely at a loss.

 

[58sniper]

Where do your DNS forwarders point?

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[ncotton]

Do you just have one DSL line into a single modem router, or do you have a DSL modem, serving a seperate router. i take it.

If you have an AD setup, the Gateway should point to the router/modem. If aren't using AD and your router is DNS enabled, then the gateway and DNS address of the clients should point directly to the router.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[nsantin]

Sounds like a bogus message, did you check for spyware/grayware/virus.

 

[ncotton]

Yeah, it does sound dodgey, but it is possible for it to be shown when a http request from a private address accesses a router....like that of a web server, or any local router.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[Andrea2255]

We have a single DSL line into a netopia router which is plugged into a linksys router. I've checked for viruses, spyware and I get nothing. Also, we are not receiving a lot of our email.

 

[Andrea2255]

Our ISP just told me to change the dns settings on the server from 10.0.0.1 to 205.x.x.x and reboot all of the workstations to pick up the new dns and that this should fix the problem. It does seem to help at the moment, but why after years of no change in our configuration did this happen and why would this affect our email? It is absolutely the strangest thing and it's driving me nuts.

 

[58sniper]

If 10.0.0.1 is your AD DNS server, you can't change that. As was my first reply - what does your DNS forwarder point to? If you change THAT to the 205.x.x.x, does the problem go away?

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[Andrea2255]

OK - DNS did not have forwarding enabled. I enabled it and put the isp addresses in there. It seems to be working alright now, but could this cause email problems as well? My boss has an external aol account and none of her emails were delivered to us yesterday. My test emails to and from gmail/yahoo/etc. all worked, but everyone said they had a lot less spam and I didn't receive the email notification that replies were posted here. However, this morning, I did get the last post's email notification. Thank you for your help -
Andrea