Menu
What's new
By:
Filters Better Search

possible DNS-rebind attack detected

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

J

JohnD5000

Very Senior Member
A whole bunch of lines like this in log. What does it mean?

Mar 25 13:01:23 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:24 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:33 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:33 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
 
JohnD5000 said:
Why would an ad be attacking my system?
Click to expand...
The message says "possible DNS-rebind attack" because it resolves to a non-standard address. Often it's a loopback address used for media streaming apps (Amazon does this). In this case it resolves to 255.255.255.255 which is kinda pointless.

Are you going to any Polish websites?
 
Last edited:
Is there any way to know which device in the network is triggering this event? I've been getting a ton to domain ignore.me for awhile now, and suspect it's the firestick but how to know for sure? Tried searching it out on google a couple times and hit dead ends. I can't morally unplug the firestick in questionfor any amount of time to see if the message goes away, because it's pretty much a 24 hour lifeline to elderly parent living with us.

Jul 11 10:05:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:05:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:11 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:12 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:12 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:40 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:10 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:10 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:15 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:35 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
 
Run this command:
Code: 
killall dnsmasq; dnsmasq --log-async --log-queries
and then look in the syslog for something like this:
Code: 
Jul 12 02:09:32 dnsmasq[22472]: query[A] ignore.me from 192.168.1.49
Then do:
Code: 
service restart_dnsmasq
 
You have a client on your lan that is checking for WAN connectivity, so there is a task that is going to look for a DNS entry...

the dns-rebind warning suggests that it's resolving to your subnet...
 
You must log in or register to reply here.

Similar threads

H
DNS-rebind attack detected: farm.plista.com. etc...??
Replies
3
Views
623
Treadler
Treadler
TanyaC
Possible DNS-Rebind attack detected and unresponsive router plus one more
Replies
3
Views
1K
TanyaC
TanyaC
H
Solved DNS Rebind Attack Message For Only Two Domains
Replies
4
Views
1K
Viktor Jaep
Viktor Jaep
C
How to make dnsmasq startup wait for USB mount?
Replies
4
Views
744
chrisisbd
C
W
RT-AX86U with latest version 3004.388.8_2 always crash and reboot
2
Replies
35
Views
4K
Ripshod
Ripshod
Similar threads
Thread starter Title Forum Replies Date
TanyaC Possible DNS-Rebind attack detected and unresponsive router plus one more Asuswrt-Merlin 3
P Custom DNS for Guest Network Possible? Asuswrt-Merlin 15
C VLAN LOT on GT-AXE 16000 with 388.2 possible? Asuswrt-Merlin 5
S Is it possible to use 5Ghz-2 on the XT8 when using it as an AiMesh node with a dual band main router? Asuswrt-Merlin 1
K Going from Home to Small business (NAS+CCTV) - AiMesh and possible managed switch Asuswrt-Merlin 8
H Possible to display router UI in an iframe? Asuswrt-Merlin 1
O Merlin + Ubi AP + isolation, is it possible? Asuswrt-Merlin 4
B It is possible to use TOR in VPN Director? Asuswrt-Merlin 9
XIII AdGuard VPN (IPSec/IKEv2) not possible as VPN client on Asuswrt-Merlin? Asuswrt-Merlin 1
L Unbound + Wireguard: is this combination possible at all? Asuswrt-Merlin 6

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 702 (members: 23, guests: 679)
Top