What's new
By:

possible DNS-rebind attack detected

J

JohnD5000

Very Senior Member
A whole bunch of lines like this in log. What does it mean?

Mar 25 13:01:23 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:24 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:33 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
Mar 25 13:01:33 dnsmasq[11170]: possible DNS-rebind attack detected: googlecm.hit.gemius.pl
 
JohnD5000 said:
Why would an ad be attacking my system?
Click to expand...
The message says "possible DNS-rebind attack" because it resolves to a non-standard address. Often it's a loopback address used for media streaming apps (Amazon does this). In this case it resolves to 255.255.255.255 which is kinda pointless.

Are you going to any Polish websites?
 
Last edited:
Is there any way to know which device in the network is triggering this event? I've been getting a ton to domain ignore.me for awhile now, and suspect it's the firestick but how to know for sure? Tried searching it out on google a couple times and hit dead ends. I can't morally unplug the firestick in questionfor any amount of time to see if the message goes away, because it's pretty much a 24 hour lifeline to elderly parent living with us.

Jul 11 10:05:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:05:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:06:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:23 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:34 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:08:36 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:13 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:20 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:09:54 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:09 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:11 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:12 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:12 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:57 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:10:59 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:22 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:11:42 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:12:44 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:27 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:40 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:13:53 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:39 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:14:41 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:29 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:15:31 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:00 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:16:02 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:10 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:10 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:15 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:37 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:18:38 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:19:51 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:05 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:07 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:28 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:30 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:20:35 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:03 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:21:16 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
Jul 11 10:22:04 dnsmasq[21237]: possible DNS-rebind attack detected: ignore.me
 
Run this command:
Code: 
killall dnsmasq; dnsmasq --log-async --log-queries
and then look in the syslog for something like this:
Code: 
Jul 12 02:09:32 dnsmasq[22472]: query[A] ignore.me from 192.168.1.49
Then do:
Code: 
service restart_dnsmasq
 
You have a client on your lan that is checking for WAN connectivity, so there is a task that is going to look for a DNS entry...

the dns-rebind warning suggests that it's resolving to your subnet...
 
You must log in or register to reply here.

Similar threads

E
Solved RT-AX86U rootfs mounted read-only after firmware upgrade to 3004.388.10
Replies
3
Views
597
exception898
E
E
Rt-ac68u with Reolink doorbell rebind attack.
Replies
17
Views
2K
eastavin
E
H
DNS-rebind attack detected: farm.plista.com. etc...??
Replies
4
Views
5K
Howard_inGA
H
TanyaC
Possible DNS-Rebind attack detected and unresponsive router plus one more
Replies
3
Views
2K
TanyaC
TanyaC
B
Control D DNS and possible DNS-rebind attacks
2
Replies
23
Views
4K
sfx2000
sfx2000
Similar threads
Thread starter Title Forum Replies Date
A Possible to disable constant DNS checks to dns.msftncsi.com? Asuswrt-Merlin 41
spacemanspiff RT-AX86U running Merlin serving DNS - possible Malware infection Asuswrt-Merlin 31
S Solved Changelog RSS feed possible? Asuswrt-Merlin 3
D Asus released new firmware for RT-AX56U 10-2025 - possible to update Merlin? Asuswrt-Merlin 8
V Not possible to set static IPs in VLAN (network with different subnet)? Asuswrt-Merlin 26
V Is this possible with Merlin? I don’t know where to start Asuswrt-Merlin 14
asceta Parental Control - are exceptions possible? Asuswrt-Merlin 1
J VPN Client - Redirect App Possible? Asuswrt-Merlin 2
A Possible to route certain sites through WAN and all others through Wireguard? Asuswrt-Merlin 5
garycnew VPNDirector Source/Destination Port-Based Split-Tunneling Rules Not Possible? Asuswrt-Merlin 6

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 3,193 (members: 22, guests: 3,171)
Back
Top
✖