Strange entries in my log

[retzer]

Hello there, longtime listener, occasional caller. I have an AC68W (68U with a white case) running 386.5. I In researching a move to 5_2 I came across some strange entries in my log. Can you give me a clue as to what's going on here?

EXAMPLE:
Mar 27 13:04:19 kernel: *** ERROR: [send_redir_page:625] # redir_url=http://192.168.1.1:80/blocking.asp?cat_id=94&mac=52D72B244CB6&domain=feed-6009.coderformylife.info
Mar 27 14:10:23 kernel: *** ERROR: [send_redir_page:625] # redir_url=http://192.168.1.1:80/blocking.asp?cat_id=94&mac=D2290C28BB65&domain=click-on-this-now.online
Mar 27 14:11:25 kernel: *** ERROR: [send_redir_page:625] # redir_url=http://192.168.1.1:80/blocking.asp?cat_id=94&mac=D2290C28BB65&domain=special-offers.online

There are about a half-dozen URLs in the logs and all look sketchy. Several different MAC addresses are involved and they belong to variety of devices: Android phones, PCs, MacBook, iPhones. All of them seem to be functioning normally.

 

[ColinTaylor]

That appears to be AiProtection doing what you've asked it to. Those are all categorised as Dangerous/Scam.

 

[retzer]

Oh wow, thanks. I used to have a lot of notices in the AI Protection logs but that stopped some time ago after a firmware update, not sure why.

 

[Zastoff]

Oh wow, thanks. I used to have a lot of notices in the AI Protection logs but that stopped some time ago after a firmware update, not sure why.

In my tests I did on 386.5alpha builds the log messages come from parental control filters, That is part of Trend Micro's stuff in the router.
Think something changed with the log level on Parental control part..

 

[max0x7ba]

That appears to be AiProtection doing what you've asked it to. Those are all categorised as Dangerous/Scam.

My logs contain similar messages but AiProtection is disabled.

The message comes from the kernel, but no further indication what sends it.

 

[drinkingbird]

My logs contain similar messages but AiProtection is disabled.

The message comes from the kernel, but no further indication what sends it.

Asus also runs its own security daemon, may be related to that. If you aren't sure, do a hard factory reset and reconfigure by hand. If you have malware, that will remove it.

 

[RMerlin]

The message comes from the kernel, but no further indication what sends it.

No, the message comes from the firmware itself. It indicates a page was being blocked, either by AiProtection, or by Parental Control.