When entering the wrong ISP password the modem still connects, but connects to a strange IP address!

[blahrer]

I have a TP-Link router/dsl modem that is set to always on. When I reset my modem recently, I entered the wrong password for my ISP account (username is correct). Now instead of returning a "fail to connect" message, the modem just connects me to some weird gateway.  The DSL light would be on as if connected to the internet, but there's no internet connectivity and Windows is showing connectivity lost.  It's just weird af. I tested this several times on bridge mode just to be sure and sure enough I keep getting redirected to this IP range : 172.23.x.x. Is there something wrong with my router config or is this on the ISP's end?

[+BudMan MVC]

172.23 is rfc1918 space, ie private - quite possible if your isp requires login that they redirect you somewhere you could register a new modem.  172.16-31 is private address space, if you have questions on why it happens contact your isp.

[blahrer]

I was hoping I could avoid dealing with my ISP directly, because who wants to? So are you 100% sure that other stuff like router misconfiguration, malware, etc... isn't the cause of this redirection?

[metallithrax]

You can trust Budman ,just take a look at his other posts.  He knows his stuff

[+BudMan MVC]

you say bridge mode?  When you modem is in bridge mode what gets that IP?

 

What is front of this TP-Link device?

 

So did you get a valid IP when you used the right login?  If so why would you be worried about it?  172.23 is private - its not routable across the internet.  If your isp gave you an IP in that range your not going any farther than your isp network.

 

rfc1918 https://tools.ietf.org/html/rfc1918

3. Private Address Space

The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets:

10.0.0.0 - 10.255.255.255 (10/8 prefix)

172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

 

https://en.wikipedia.org/wiki/Private_network

[+John Teacake MVC]

Oh you say you get redirected to some kind of portal? Can you screenshot it. Slightly off topic but maybe not It could be a carrier grade NAT IP, Its becoming more common in the UK...Who is your ISP?

[+BudMan MVC]

^ to the portal thing, as I mentioned before this quite often a portal to register a new modem.  Or sure as John Teacake mentions could be a carrier grade natting system.

 

For example when you use a new cable modem with comcast here in the chicagoland area, it will connect and you do get an IP but you can only go to the registration page for the modem to tie it to your account so you can actually go to the internet.  Have not actually done this is a while so I don't recall if the IP you got was public or rfc1918..  But you could not go anywhere other than the registration page for the modem.

[blahrer]

Yupe. It was my ISP's own portal. But now I have another question... Why is it that all the devices connected to my router are getting the same search results from google? Can the trackers not tell that that one public IP address is being used by many different devices? For instance, if my Ipad is connected, my google searches on my PC will be filled with Apple stuff.

[+BudMan MVC]

you have 1 IP..  As to google telling its being multiple devices.. If they use cookies they could tell who is searching.

 

But I am confused as to filled with apple stuff?  What stuff are you talking about?  Google provides me with what I search with..

[blahrer]

My search results are frustratingly irrelevant, weird and seems to be coming from a certain country that I've never been to. Looks suspiciously like a google redirect virus. To be clear, the PC is mine. All other devices in the household belongs to family members so we shouldn't be getting the same personalized/spammy search results. FYI, on my PC I always log out of all google accounts, Chrome set to block cookies with adblockers and tracking protection. Scanned my PC with various AV programs and found nothing. So it makes me wonder if one of the other devices is causing this (spreading a worm). Or my router has been hacked. OR it could be an IPv6 incompatibility thing. I really have no idea. Getting the same irrelevant (spammy) search results on all devices is just weird.

[+BudMan MVC]

can you give an example of a search term you search for and then the spammy results you get?  So for example here I searched for pizza in chicago

 

 

I don't see any sort of spammy anything in this search.

[+John Teacake MVC]

Tracking cookies/beacons/etc etc etc there is so much of this ######... will track you round, So if I go to work I would be browsing the web and adverts would be relevant to me and if I go home etc... (Well they wouldn't because I use PiHole and uBlock but that's a different matter ) Anyway... For YOU as a user it would be the same.

 

Post a screenshot from both devices, It would be pretty obvious if its a redirect virus.

[blahrer]

Searching for commercial keywords sort of defeats the purpose now doesn't it? Try this search and let me know what results you get. 

keywords : ghostery breaks shoryuken.com

 

Notice the very weird websites that tend to crop up near the bottom of the pages?

[+BudMan MVC]

So you don't understand that odd search terms and odd ###### turn up odd ###### on google??

 

Point out the stuff that is different.. My search for those terms pretty much looks identical..

 

[boo_star]

Have you been to those websites and searched for the terms you used in your query?

 

Its quite commonplace for sites like that to use keyword stuffing (throwing a lot of keywords onto the page and using tricks to hide them from a casual glance.)

 

Although Google does have ways of detecting keyword stuffing, it's not accurate 100% of the time.

[blahrer]

That's not an odd search term, it's a pretty straight forward query. The search result is what is odd here. But nice to know that it isn't a redirect virus but just google sucking for anything other than shopping results. To answer the other guy's question, no I've never been to any of those websites before. So it's called keyword stuffing huh? Google really ought to do something about that. Most of the time I have to filter the search with the added "-(any keyword that's being spammed in the result page)" to get better results.  

But, it still doesn't explain one thing. Why do all the devices in the household get the same personalized searches? For example, if I watch X video on youtube, then X video tend to show up as recommended videos on the other devices. Is google really tying all these devices to the same IP? Mind you these devices are not shared.

[+BudMan MVC]

"just google sucking for anything other than shopping results. "

 

Nobody says you have to use google - go play with bing, maybe they won't track you so much

[blahrer]

Bing sucks too. So is the samey personalized searches the result of the same IP being being shared by all my devices? Also my firewall is reporting connection attempts from my other devices when they connect to the wifi. Is this normal behavior?  

[n_K]

On 18/06/2016 at 3:29 PM, blahrer said:

Searching for commercial keywords sort of defeats the purpose now doesn't it? Try this search and let me know what results you get. 

keywords : ghostery breaks shoryuken.com

 

Notice the very weird websites that tend to crop up near the bottom of the pages?

You are joking, right? You're wondering why your search terms are not being stored and so you post pictures showing it with the browser showing you are in incognito mode... Well I never, using incognito mode my cookies are not being stored or read across sessions.... *whistles*

[blahrer]

On 6/20/2016 at 7:04 PM, n_K said:

You are joking, right? You're wondering why your search terms are not being stored and so you post pictures showing it with the browser showing you are in incognito mode... Well I never, using incognito mode my cookies are not being stored or read across sessions.... *whistles*

What is your point exactly? What makes you think I want my search terms to be stored? I'm trying to get ORGANIC search results here without any form of personalization. So why would I want google to remember me? If you read my previous posts you'll see the problem I'm having is that all the devices connected to my router are getting the same personalized search results. It was really annoying getting personalized content from other people and vice versa (Each device is owned by another member of the household and NOT under the same account). I am trying to avoid that on my PC by going incognito. I thought I was still being served the same personalized stuff in incognito mode, but BudMan proved that wasn't the case. So google sucks even without personalization. Whatever. I'm more concerned now that my network might have been compromised by malware. Why are multiple devices behind a single router profiled by these tracking websites as a single user. Either my router is infected or it could just be bad router settings. Any suggestions on where I might look first?

[+BudMan MVC]

where is your example of personalized results.. What I showed is I got the same results that you got when I search..  This point to no personalized results.. Be it your happy with what the results were are not - I don't see how that is personalized..

 

Thinking your infected with some malware that is injecting stuff into your search results.. To be honest maybe your tinfoil hat needs to be loosed a bit..

[blahrer]

Then explain this to me in a pure networking sense. I am on my PC with firefox visiting youtube and watching a very specific channel, let's say thooorin's channel. All the while being signed out of any accounts. My relative, who is on his ipad with safari, which is NOT shared with me, and is signed in using his account is connected to the wifi. The next time he goes to youtube he will see a bunch of videos by "thooorin" popping up on his mainpage as recommended channels. He does not watch those kind of stuff or anything even related to video gaming on his ipad. So how does this happen? Cookies? IP address? Router info? If google's behavioral marketing is what's causing this then google sucks and there's nothing i can do about it. I'm more concerned that some app on our devices could be leaking browsing data to advertisers.

 

Also tell me if there's any problems here with my current setup:

I have only one router that acts as a modem and connected directly to a phone line and all devices are connected to this router. PC through wired connection, everything else is on wifi. Nat firewall and dhcp enabled. My ISP connects me through their private network, meaning my WAN IP address would be an internal one that starts with 10.x.x.x. But websites would see a public IP address(dynamic). So I am behind a double NAT. DNS is auto except for my PC which is using DNScrypt. My ISP recommends that users switch to an IPv6 capable modem. Right now my modem is IPv4 only but can still work with their network. Meanwhile Apple has dropped their support for IPv4 for the Ipad.  

 

One last thing Budman, can you take a screen shot of youtube's front page(region: worldwide) with history turned off. I wanna see how many local stuff is still inserted in. And do a quick search of whatever on youtube and I'll compare. 

[blahrer]

Another thing. What is that long number that appear in the URL when performing a google search. Like this > =serp.3...0.0.0.183162.0.0.0.0.0.0.0.0..0.0....0...1c..64.serp..0.0.0.lAUWFGfc1wI

I noticed that when it's there the search results are re-arranged with some pages moved higher or lower.

[+BudMan MVC]

what do want a screenshot of?  Show example..  I am not a very big youtube user.. I never browse it, only time I ever see anything on it via a directly link the the video from some other page, etc.

 

As to localized stuff. Yes whatever you public IP your talking to any site can look up the general area your in.. Its not like I tv where they show a dot on your house.. But yes they can get close really easy depending on the information your isp has provided to where their networks are located.

 

Yes it quite simple for any company to track the IP your coming from and say oh that IP was looking at videos of type X, and then as new session from same IP is opened to continue with same thread of stuff.  This has does not have to have anything to do with the cookies or information being seen by the server your talking to.. It can be related to the IP your coming from for sure.

 

I still don't understand the issue is with this - if you don't like it, don't use google products.. But to be honest all companies do this so you might as just disconnect from the internet.

 

If you want them to personalize it, then yeah log in.. So they can tell you from the different users coming from the same IP.

[blahrer]

There isn't much choices out there. I just want good organic search results without being bombarded with websites trying to steer you to their advertisers. If there was a good alternative to google products I would be using it already. About the long google url though, is it to tell google that another tab has been opened from the same browser so as to identify it as the same session? As for the youtube screenshot, just search for the word "election" while choosing worldwide as your region. Youtube history has to be turned off of course. I'll compare it to what I'm getting so it would be very obvious which videos are inserted in and from which country.