HooYu is a UK-based identification service, dealing with things like customer identification. document validation, fraud prevention, etc. They were acquired by another identification service company, Mitek, back in 2022.
NatWest is a UK-based bank. They are partnered with Mitek who provide fraud prevention services. So the domain hooyu-id.natwest.com is legitimate and relates to how NatWest is providing those services to its online products.
Fatture in Cloud's privacy policy states they share information with banks and third-party service providers.
This doesn't solve the puzzle of why you had a HooYu NatWest https site load up when accessing Fatture's login, nor does it explain why this problem went away when you switched to Cloudflare's DNS, but it looks like these are all legitimate services and all related to finance and fraud prevention, so it makes sense, sort of.
It may have been a temporary misconfiguration with the online services, or it may have been something browser-based – for example if a previous site also used these services and you had cookies saved for that domain, causing the service to try and load content for the wrong domain.
Are you able to repeat what you saw when you try again now? What happens if you clear your browser's cache and cookies and try again? What about if you try a different browser on a different computer which also uses Pi-hole?
First of all, thanks for the help.
Yes... I have try with some other PC on my LAN,
also I have make a new Windows11 VM under my ProxMox server, but the result is the same.
Also I have try Chrome, Firefox and Edge... and same result too.
But what I really don't understand is the different certificate on the https://secure.fattureincloud.it/ site.
Can be that the fattureincloud.it give me another certificate when I have some conditions ?
Have you some other idea please ?
Try running these four commands from your Windows VM where you are seeing this problem. What outputs do you get for each command? Replace PIHOLE_IP with the IP address of your Pi-hole on your network.
Thankyou. What is mydomain.com? Is this replacement text for a domain owned by you? What is that 151 IP address, is that something belonging to you? This is what I get for all three fatture tests:
It appears that something on your network or computers is causing that domain to resolve to your own IP instead of the proper IP, regardless of which DNS server you ask. That would be a cause of a certificate error though I'm not sure why that natwest address is relevant – perhaps this was also resolved previously as part of a site and is cached.
I don't use OPNsense – have a look for any obvious alias definitions or firewall type rules that might be relevant. You mentioned you'd tried this on another computer and had the same results. Are both computers running copies of the same security software (if any), such as antivirus software? Are they running applications from a finance-related organisation?
That final ATLAS test you did shows that an external DNS query was not intercepted. But if you query this domain on Cloudflare you get the same result as on your Pi-hole. But originally it was changing to that DNS server which fixed the problem.
Can you create a debug log please and post the token URL it gives you. You can do this in Tools > Generate debug log >Upload debug log and provide Debug token > Generate debug log .
I didn't know of this type of debug log
I have generate it and because I so that I can't send you e prvt. message,
I paste here the token code: xxxxx
...hope you know the rest of the link
Dear Chris,
I have just install the AdGuard plugin in my OpnSense router and all work so nice.
C:\Users\denis>nslookup secure.fattureincloud.it
Server: router
Address: 192.168.1.1
Risposta da un server non autorevole:
Nome: secure.fattureincloud.it
Addresses: 34.250.82.27
63.32.120.74
63.32.221.69
It anyway remain very strange think... but I have no more ideeas, so I changed.
It is a diagnostic log which gathers information about your Pi-hole and its configuration and makes it available to a small number of Pi-hole people on a secure server for 48 hours, after which it is purged. You create the log as described above and post the https://tricorder.pi-hole.net link here. There is no need for a private message, only Pi-hole people can access it.
