Weird website issue - seem to be something with the router..

[dave14305]

-I enabled - no change
-Browsing to that url - I get anther page off the same erroneous site (see screengrab)
-Whatever DNS I have set. I can do that cloudflare or google through the adapter settings. If I leave it on auto I end up with Charter/Spectrum DNS servers - seems to be behaving correctly
-Yes its just a model - no other features just a lan port that goes into the AC-1900P

So just as a stab in the dark, what if you disable that YouTube downloader extension? Let's just try to focus on one device to figure out how this is happening. Any AV software that purports to offer "DNS protection"?

 

[ex313]

So just as a stab in the dark, what if you disable that YouTube downloader extension? Let's just try to focus on one device to figure out how this is happening. Any AV software that purports to offer "DNS protection"?

I get the same result on multiple PC's, My LG Android Phone and my kids Apple Ipod Touch. I don't think its client related - there has to be something in the router.
I just turned the VPN on my phone - and the .biz site came up correctly.

I am about to go buy a new router.

 

[Adamm]

I get the same result on multiple PC's, My LG Android Phone and my kids Apple Ipod Touch. I don't think its client related - there has to be something in the router.
I just turned the VPN on my phone - and the .biz site came up correctly.

I am about to go buy a new router.

Is your modem in bridge mode? Seems to be more then meets the eye with this issue.

 

[ex313]

Is your modem in bridge mode? Seems to be more then meets the eye with this issue.

Wireless router mode / AiMesh Router mode (Default) - is checked

 

[RMerlin]

What do you get if you run this standard test - does it return your ISP's DNS?

https://www.dnsleaktest.com/

 

[dave14305]

Trying to wrap my head around the fact that the https site was also hijacked and what must be true in order for that to happen? Where can an HTTPS connection get MITM?

 

[dave14305]

-I enabled - no change
-Browsing to that url - I get anther page off the same erroneous site (see screengrab)
-Whatever DNS I have set. I can do that cloudflare or google through the adapter settings. If I leave it on auto I end up with Charter/Spectrum DNS servers - seems to be behaving correctly
-Yes its just a model - no other features just a lan port that goes into the AC-1900P

If you drill down into the padlock and view the cert for the https site, what are the details and what CA issued it?

My view of it:

 

[ex313]

What do you get if you run this standard test - does it return your ISP's DNS?

https://www.dnsleaktest.com/

I did it with quad 9 enabled, google dns set on the pc and cloudflare set on the router - everything cam back as it should.

 

[ex313]

If you drill down into the padlock and view the cert for the https site, what are the details and what CA issued it?

My view of it:
View attachment 19664

 

[dave14305]

This chump is stumped.

 

[ex313]

I just dug out my old Linksys WRT54 running Tomato and replaced the AC-1900P

Everything is working as it should, the website is coming up correctly on my pc and over wifi on the phone. The issue is 100% with the router. Unless there is something else I can do to reset it - I am looking at buying new hardware.

Whats a good step up from an AC-1900P ?

 

[Makaveli]

I just dug out my old Linksys WRT54 running Tomato and replaced the AC-1900P

Everything is working as it should, the website is coming up correctly on my pc and over wifi on the phone. The issue is 100% with the router. Unless there is something else I can do to reset it - I am looking at buying new hardware.

Whats a good step up from an AC-1900P ?

Asus RT-AC86U

 

[dave14305]

I just dug out my old Linksys WRT54 running Tomato and replaced the AC-1900P

Everything is working as it should, the website is coming up correctly on my pc and over wifi on the phone. The issue is 100% with the router. Unless there is something else I can do to reset it - I am looking at buying new hardware.

Whats a good step up from an AC-1900P ?

Maybe you want to try reflashing using the ASUS Restoration Utility to ensure a clean firmware image. Other experts can chime in on the best way to ensure a complete wipe and fresh start.
https://www.asus.com/us/support/FAQ/1030652

 

[dave14305]

When you are removing the router from the equation and plugging in the PC directly or the Linksys router (both with different MAC addresses than the router), do you get a different WAN IP? Maybe this website is playing tricks based on your usual WAN IP.

 

[martinr]

.......Unless there is something else I can do to reset it - I am looking at buying new hardware.
.....

A bit of a drastic solution?

There’s always L&LD’s “Nuclear” reset you could try

https://www.snbforums.com/threads/major-issues-w-rt-ac86u.56342/page-4#post-495710

but before you take a sledgehammer to it and lose any evidence, I imagine there’s a lot of people who’d love to get to the root of it and find out what exactly caused the problem.

 

[RMerlin]

When you reset it, don't forget to also check the option telling it to erase everything, which will include the JFFS partition.

 

[ex313]

I just spent the last hour doing firmware updates (both ASUS and Merlin) NVRAM resets and GUI based resets with power time off( Nuclear Reset). There is no change in how this router is behaving.

 

[ex313]

When you reset it, don't forget to also check the option telling it to erase everything, which will include the JFFS partition.

View attachment 19667

Did that along with the gui jffs wipe and an ssh command line jffs delete.

 

[ColinTaylor]

I just spent the last hour doing firmware updates (both ASUS and Merlin) NVRAM resets and GUI based resets with power time off( Nuclear Reset). There is no change in how this router is behaving.

Straw clutching time.... Can you clone the MAC address of your PC (or any device really) onto the router's WAN interface and then power cycle both your modem and the router. That should give you a different public IP address. (I assume you're not using IPv6?)

 

[ex313]

Straw clutching time.... Can you clone the MAC address of your PC (or any device really) onto the router's WAN interface and then power cycle both your modem and the router. That should give you a different public IP address. (I assume you're not using IPv6?)

I will pull power on the cable modem, give it a 20 minuted and it should pull a new IP.