Probe Hijacking

Problem description

The customer task settings performed DNS hijacking (IP whitelist). During the monitoring period, an error "Page Hijacked (DNS Hijacking)" Error was found;

Check Scatter Plot and find that they are all under the same IP.

Troubleshooting process

Check the phenomenon: It is found that the error Probe is reported under the same IP and the same ID, Probe ID: 8922374. This problem does not exist in other regions, and other Probe IDs under the same client IP do not have this problem, so the initial judgment is that it is a Probe problem.

2. To reproduce, use the Probe Instant Testing to access and see if it can be reproduced. It is found that the unknown Host is still parsed, and the Host IP is: 198.18.12.22

3. Check the information from the packet capture and find that the DNS resolution is indeed 198.18.12.22

4. Analyze Probe and use this Probe to access other pages, such as Baidu and Tingyun official website, and find the same phenomenon.
(1) Baidu

(2) Listen to the cloud

Problem summary

If an error is reported under the same ID, it means that it is a Probe problem, not a client or operator problem.

Use Probe to reproduce, and found that it can be reproduced, it will occur, and it is not an accident.

Use Probe to visit other common pages, JD.com, Baidu, Taobao, Tingyun, etc. The discovery can be reproduced.

The above summary is the Probe problem.

Problem description#

Troubleshooting process#

Problem summary#

Problem description

Troubleshooting process

Problem summary