News for hackers. Stuff that matters.
Re:This JPEG is also a webpage by slice-beans on Wednesday August 10, 2016 @04:29PM (#12264555)
Here's the request and response from router: http://pastebin.com/e7rxLsGJ

The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...

Re:This JPEG is also a webpage by detaro on Wednesday August 10, 2016 @04:47PM (#12264650)
I found some references online to something called "Smart Setup", which you can apparently turn of under Advanced Settings -> Home Network -> Smart Setup, but no idea what it actually does and why it intercepts random requests...
Re:This JPEG is also a webpage by fosk on Wednesday August 10, 2016 @04:35PM (#12264594)
Besides the model number, can you also tell us the firmware version?
Re:This JPEG is also a webpage by slice-beans on Wednesday August 10, 2016 @06:15PM (#12265107)
BT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11

But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences.

Sorry it wasn't any more interesting than that.

Edit: the reason it took me a while to figure this out was that the settings page it was redirecting to was nothing to do with parental controls!

Re:This JPEG is also a webpage by rad_gruchalski on Wednesday August 10, 2016 @06:38PM (#12265210)
The HomeHub 5 is a Thomson (Technicolor) router, if I remember correctly.
Re:This JPEG is also a webpage by neom on Thursday August 11, 2016 @02:09AM (#12266542)
So how did you figure it out?
Re:This JPEG is also a webpage by slice-beans on Thursday August 11, 2016 @03:02AM (#12266671)
I visited some other black listed sites <.< >.> and discovered the pattern, then dug around in the router settings to see what had changed. Disabling parental controls sorted it and I can now see the squirrel/chipmunk/unidentified rodent.

Lesson learned: just use a VPN.

Re:This JPEG is also a webpage by Jaruzel on Thursday August 11, 2016 @06:21AM (#12267137)
> I visited some other black listed sites <.< >.>

Is that an ASCII representation of what I think it is? (a well known .cx site)

Re:This JPEG is also a webpage by slice-beans on Thursday August 11, 2016 @12:25PM (#12269558)
It was shifty eyes. But good imagination skills +1
Re:This JPEG is also a webpage by sundarurfriend on Thursday August 11, 2016 @10:16AM (#12268381)
I saw it as just a 'shifty-eyes' emoticon, but then again I don't know of said .cx-site so I maybe missing it.
Re:This JPEG is also a webpage by Olap84 on Thursday August 11, 2016 @04:15AM (#12266838)
aaisp - your life just became simpler.
Re:This JPEG is also a webpage by gcb0 on Wednesday August 10, 2016 @11:06PM (#12266104)
the fact that it encodes "/" on a part of the url in a parameter, but not on another is a very good indication that whatever this 'feature' is doing is badly thought out and the implementation was done by the intern.
Re:This JPEG is also a webpage by SmellyGeekBoy on Thursday August 11, 2016 @07:58AM (#12267459)
This pretty much describes the entire BT HomeHub firmware, to be honest.
Re:This JPEG is also a webpage by alanh on Wednesday August 10, 2016 @06:17PM (#12265118)
"Deployed on one out of four residential gateways globally, Cisco Videoscape OpenRG is the industry's most widely used residential gateway software." -- Cisco

At least we know a little about the software issuing this redirect!